@odla-ai/cli 0.7.1 → 0.9.0

package/dist/bin.cjs

@@ -27,11 +27,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
-// src/cli.ts
-var import_security2 = require("@odla-ai/security");
-
 // src/admin-ai.ts
-var import_node_process4 = __toESM(require("process"), 1);
+var import_node_process5 = __toESM(require("process"), 1);
 
 // src/token.ts
 var import_db = require("@odla-ai/db");
@@ -261,9 +258,32 @@ function platformAudience(value) {
   return url.origin;
 }
 
+// src/secret-input.ts
+var import_node_process3 = __toESM(require("process"), 1);
+var MAX_BYTES = 64 * 1024;
+async function secretInputValue(options, kind = "credential") {
+  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
+  let value;
+  if (options.fromEnv) value = import_node_process3.default.env[options.fromEnv];
+  else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();
+  else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
+  value = value?.replace(/[\r\n]+$/, "");
+  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : `stdin ${kind} is empty`);
+  if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+  return value;
+}
+async function readSecretStream(kind, stream = import_node_process3.default.stdin) {
+  let value = "";
+  for await (const chunk of stream) {
+    value += String(chunk);
+    if (value.length > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+  }
+  return value;
+}
+
 // src/admin-ai-auth.ts
 var import_node_fs2 = require("fs");
-var import_node_process3 = __toESM(require("process"), 1);
+var import_node_process4 = __toESM(require("process"), 1);
 var import_db2 = require("@odla-ai/db");
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -271,7 +291,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = import_node_process3.default.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = import_node_process4.default.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -283,7 +303,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = import_node_process3.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = import_node_process4.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -293,7 +313,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const tokenFile = options.tokenFile ?? `${import_node_process3.default.cwd()}/.odla/admin-token.local.json`;
+  const tokenFile = options.tokenFile ?? `${import_node_process4.default.cwd()}/.odla/admin-token.local.json`;
   const cache = readJsonFile(tokenFile);
   const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -308,13 +328,13 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     onCode: async ({ userCode, expiresIn }) => {
       const approvalUrl = handshakeUrl(audience, userCode);
       out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      const shouldOpen = options.open === true || options.open !== false && !import_node_process3.default.env.CI && Boolean(import_node_process3.default.stdin.isTTY && import_node_process3.default.stdout.isTTY);
+      const shouldOpen = options.open === true || options.open !== false && !import_node_process4.default.env.CI && Boolean(import_node_process4.default.stdin.isTTY && import_node_process4.default.stdout.isTTY);
       if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
     }
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
   tokens[scope] = { token, expiresAt };
-  if ((0, import_node_fs2.existsSync)(`${import_node_process3.default.cwd()}/.git`)) ensureGitignore(import_node_process3.default.cwd(), [tokenFile]);
+  if ((0, import_node_fs2.existsSync)(`${import_node_process4.default.cwd()}/.git`)) ensureGitignore(import_node_process4.default.cwd(), [tokenFile]);
   writePrivateJson(tokenFile, { platform: audience, tokens });
   out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   return token;
@@ -475,7 +495,7 @@ function isRecord2(value) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? import_node_process4.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? import_node_process5.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -514,7 +534,7 @@ async function adminAi(options) {
   }
   if (options.action === "credential-set") {
     const provider = requireProvider(options.credentialProvider);
-    const value = await credentialValue(options);
+    const value = await secretInputValue(options);
     const res2 = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {
       method: "PUT",
       headers,
@@ -624,25 +644,6 @@ function requireProvider(value) {
   }
   return value;
 }
-async function credentialValue(options) {
-  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
-  let value;
-  if (options.fromEnv) value = import_node_process4.default.env[options.fromEnv];
-  else if (options.stdin) value = await (options.readStdin ?? readStdin)();
-  else throw new Error("credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments");
-  value = value?.replace(/[\r\n]+$/, "");
-  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : "stdin credential is empty");
-  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error("credential exceeds 64 KiB");
-  return value;
-}
-async function readStdin() {
-  let value = "";
-  for await (const chunk of import_node_process4.default.stdin) {
-    value += String(chunk);
-    if (value.length > 64 * 1024) throw new Error("credential exceeds 64 KiB");
-  }
-  return value;
-}
 function policyArray(body) {
   if (isRecord3(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord3);
   if (isRecord3(body) && isRecord3(body.policies)) return Object.values(body.policies).filter(isRecord3);
@@ -747,15 +748,76 @@ function addOption(options, name, value) {
   else options[name] = [String(current), String(value)];
 }
 
+// src/admin-command.ts
+async function adminCommand(parsed) {
+  const area = parsed.positionals[1];
+  const action = parsed.positionals[2];
+  const credentialSet = action === "credential" && parsed.positionals[3] === "set";
+  const credentials = action === "credentials";
+  const models = action === "models";
+  const usage = action === "usage";
+  const audit = action === "audit";
+  if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
+    throw new Error('unknown admin command. Try "odla-ai admin ai show".');
+  }
+  assertArgs(parsed, [
+    "platform",
+    "json",
+    "open",
+    "provider",
+    "model",
+    "enabled",
+    "max-input-bytes",
+    "max-output-tokens",
+    "max-calls-per-run",
+    "from-env",
+    "stdin",
+    "discovery-provider",
+    "discovery-model",
+    "validation-provider",
+    "validation-model",
+    "app-id",
+    "env",
+    "run-id",
+    "limit"
+  ], credentialSet ? 5 : action === "set" ? 4 : 3);
+  await adminAi({
+    action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
+    purpose: action === "set" ? parsed.positionals[3] : void 0,
+    provider: stringOpt(parsed.options.provider),
+    model: stringOpt(parsed.options.model),
+    enabled: boolOpt(parsed.options.enabled),
+    maxInputBytes: numberOpt(parsed.options["max-input-bytes"], "--max-input-bytes"),
+    maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
+    maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
+    platform: stringOpt(parsed.options.platform),
+    json: parsed.options.json === true,
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
+    fromEnv: stringOpt(parsed.options["from-env"]),
+    stdin: parsed.options.stdin === true,
+    discoveryProvider: stringOpt(parsed.options["discovery-provider"]),
+    discoveryModel: stringOpt(parsed.options["discovery-model"]),
+    validationProvider: stringOpt(parsed.options["validation-provider"]),
+    validationModel: stringOpt(parsed.options["validation-model"]),
+    appId: stringOpt(parsed.options["app-id"]),
+    env: stringOpt(parsed.options.env),
+    runId: stringOpt(parsed.options["run-id"]),
+    limit: numberOpt(parsed.options.limit, "--limit")
+  });
+}
+
 // src/capabilities.ts
 var CAPABILITIES = {
   cli: [
     "register the app and enable configured services per environment",
     "issue, persist, and explicitly rotate configured service credentials",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
     "push db schema/rules and configure platform AI, auth, and deployment links",
     "validate config offline and smoke-test a provisioned db environment",
     "run app-attributed hosted security discovery and independent validation without provider keys",
+    "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
     "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
   ],
   agent: [
@@ -768,12 +830,14 @@ var CAPABILITIES = {
     "consent to production changes with --yes",
     "request destructive credential rotation explicitly",
     "review application semantics, security findings, releases, and merges",
-    "approve redacted-source disclosure before hosted security reasoning"
+    "approve redacted-source disclosure before hosted security reasoning",
+    "approve GitHub App repository access separately from redacted-snippet disclosure"
   ],
   studio: [
     "view telemetry and environment state",
     "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
-    "configure system AI purposes and view app/environment/run-attributed usage"
+    "configure system AI purposes and view app/environment/run-attributed usage",
+    "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
   ]
 };
 function printCapabilities(json = false, out = console) {
@@ -1170,14 +1234,107 @@ async function doctor(options) {
   }
 }
 
-// src/init.ts
+// src/help.ts
 var import_node_fs6 = require("fs");
+function cliVersion() {
+  const pkg = JSON.parse((0, import_node_fs6.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  return pkg.version ?? "unknown";
+}
+function printHelp() {
+  console.log(`odla-ai
+
+Usage:
+  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai capabilities [--json]
+  odla-ai admin ai show [--platform https://odla.ai] [--json]
+  odla-ai admin ai models [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]
+  odla-ai admin ai credentials [--json]
+  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--limit <1-200>] [--json]
+  odla-ai security github connect [--repo owner/name] [--env dev] [--no-open]
+  odla-ai security github disconnect --source <id> [--env dev] [--yes]
+  odla-ai security plan [--env dev] [--json]
+  odla-ai security sources [--env dev] [--json]
+  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
+  odla-ai security status <job-id> [--follow] [--json]
+  odla-ai security report <job-id> [--json]
+  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
+  odla-ai security run [target] --self --ack-redacted-source
+  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
+  odla-ai version
+
+Commands:
+  setup        Install offline odla runbooks for common coding-agent harnesses.
+  init         Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor       Validate and summarize the project config without network calls.
+  capabilities Show what the CLI automates vs agent edits and human checkpoints.
+  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
+  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
+  provision    Register services, configure them, persist credentials, optionally push secrets.
+  smoke        Verify local credentials, public-config, live schema, and db aggregate.
+  skill        Same installer; --agent accepts all, claude, codex, cursor,
+               copilot, gemini, or agents (repeatable or comma-separated).
+  secrets      Push configured db/o11y secrets into the Worker via wrangler
+               stdin; set stores a tenant-vault secret and set-clerk-key the
+               reserved Clerk secret key, write-only from stdin or an env var.
+  version      Print the CLI version.
+
+Safety:
+  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
+  --yes to provision it; use --dry-run first to inspect the resolved plan.
+  Provision caches the approved developer token and service credentials under
+  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
+  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision opens the approval page automatically in interactive terminals;
+  use --open to force browser launch or --no-open to suppress it.
+  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
+  for a PAT or provider key. GitHub read access is separate from the explicit
+  --ack-redacted-source consent and the exact --plan-digest printed by security
+  plan are required before bounded snippets reach System AI.
+  Run security plan first to inspect the admin-selected providers, models,
+  per-route bounds, credential readiness, retention, no-execution boundary,
+  and digest that binds consent to that exact plan.
+`);
+}
+
+// src/harness-options.ts
+function harnessList(parsed) {
+  const selected = [
+    ...harnessOption(parsed.options.agent, "--agent"),
+    ...harnessOption(parsed.options.harness, "--harness")
+  ];
+  return selected.length ? selected : ["all"];
+}
+function harnessOption(value, flag) {
+  if (value === void 0) return [];
+  if (typeof value === "boolean") throw new Error(`${flag} requires a harness name`);
+  const raw = Array.isArray(value) ? value : [value];
+  const parts = raw.flatMap((item) => item.split(","));
+  if (parts.some((item) => !item.trim())) {
+    throw new Error(`${flag} requires a harness name`);
+  }
+  return parts.map((item) => item.trim());
+}
+
+// src/init.ts
+var import_node_fs7 = require("fs");
 var import_node_path5 = require("path");
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path5.resolve)(options.rootDir ?? process.cwd());
   const configPath = (0, import_node_path5.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs6.existsSync)(configPath) && !options.force) {
+  if ((0, import_node_fs7.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -1186,10 +1343,10 @@ function initProject(options) {
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs6.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
-  (0, import_node_fs6.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs6.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs6.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
+  (0, import_node_fs7.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs7.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs7.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
@@ -1198,8 +1355,8 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs6.existsSync)(path)) return;
-  (0, import_node_fs6.writeFileSync)(path, text);
+  if ((0, import_node_fs7.existsSync)(path)) return;
+  (0, import_node_fs7.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   return `export default {
@@ -1288,7 +1445,7 @@ function relativeDisplay(path, rootDir) {
 // src/provision.ts
 var import_apps2 = require("@odla-ai/apps");
 var import_ai = require("@odla-ai/ai");
-var import_node_process5 = __toESM(require("process"), 1);
+var import_node_process6 = __toESM(require("process"), 1);
 
 // src/provision-credentials.ts
 var import_apps = require("@odla-ai/apps");
@@ -1592,7 +1749,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process5.default.env[cfg.ai.keyEnv];
+      const key = import_node_process6.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -1652,6 +1809,219 @@ async function safeText2(res) {
   }
 }
 
+// src/secrets-set.ts
+var import_ai2 = require("@odla-ai/ai");
+var import_apps3 = require("@odla-ai/apps");
+var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
+async function secretsSet(options) {
+  const name = (options.name ?? "").trim();
+  if (!name) throw new Error('secret name is required, e.g. "odla-ai secrets set clerk_webhook_secret --env dev --stdin"');
+  if (name.startsWith("$")) {
+    throw new Error('"$"-prefixed vault names are platform-reserved; for the Clerk secret key use "odla-ai secrets set-clerk-key"');
+  }
+  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  try {
+    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);
+  } catch (err) {
+    throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value));
+  }
+  out.log(`${name} stored in the ${tenantId} vault (write-only; the value was never echoed and cannot be read back here)`);
+}
+async function secretsSetClerkKey(options) {
+  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
+  if (!value.startsWith("sk_")) throw new Error("the Clerk secret key must start with sk_ (sk_test_\u2026 or sk_live_\u2026)");
+  if (value.startsWith("sk_test_") && PROD_ENV_NAMES2.has(options.env)) {
+    throw new Error(`refusing to store an sk_test_ Clerk key for "${options.env}" \u2014 use the production instance's sk_live_ key`);
+  }
+  if (value.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
+    throw new Error(`refusing to store an sk_live_ Clerk key for "${options.env}" without --yes (live users would sync into a non-prod tenant)`);
+  }
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({ value })
+  });
+  if (!res.ok) {
+    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text || "request failed"}`);
+  }
+  out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
+}
+function scrubValue(text, value) {
+  return redactSecrets(text).split(value).join("[value redacted]");
+}
+async function resolveVaultWrite(options) {
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.envs.includes(options.env)) {
+    throw new Error(`env "${options.env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  if (PROD_ENV_NAMES2.has(options.env) && !options.yes) {
+    throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
+  }
+  const value = await secretInputValue(options, "secret");
+  return { cfg, tenantId: (0, import_apps3.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
+}
+
+// src/security-command-context.ts
+var import_promises = require("readline/promises");
+async function hostedSecurityContext(parsed, dependencies) {
+  const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+  const cfg = await loadProjectConfig(configPath);
+  const env = stringOpt(parsed.options.env) ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) {
+    throw new Error(`env "${env ?? ""}" is not declared in ${configPath}`);
+  }
+  const platform = platformAudience(stringOpt(parsed.options.platform) ?? cfg.platformUrl);
+  if (platformAudience(cfg.platformUrl) !== platform) {
+    throw new Error("--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there");
+  }
+  const doFetch = dependencies.fetch ?? fetch;
+  const stdout = dependencies.stdout ?? console;
+  const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath, open, openApprovalUrl: dependencies.openUrl },
+    doFetch,
+    stdout
+  );
+  return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
+}
+async function interactiveConfirmation(message, dependencies) {
+  if (dependencies.confirm) return dependencies.confirm(message);
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const prompt = (0, import_promises.createInterface)({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await prompt.question(`${message} [y/N] `);
+    return /^y(?:es)?$/i.test(answer.trim());
+  } finally {
+    prompt.close();
+  }
+}
+function requiredSecurityPositional(parsed, index, label) {
+  const value = parsed.positionals[index];
+  if (!value) throw new Error(`${label} is required`);
+  return value;
+}
+function securityProfile(value) {
+  if (value === void 0) return void 0;
+  if (value === "odla" || value === "cloudflare-app" || value === "generic") return value;
+  throw new Error("--profile must be odla, cloudflare-app, or generic");
+}
+
+// src/security-command-output.ts
+function printHostedSecurityPlan(out, plan, appId) {
+  out.log(`Hosted security plan for ${appId}/${plan.env}: ${plan.ready ? "ready" : "not ready"}`);
+  out.log(`  plan digest: ${plan.planDigest}`);
+  out.log(`  consent/report/redaction: ${plan.consentContract} \xB7 ${plan.reportProjection} \xB7 ${plan.redactionContract}`);
+  out.log(`  prompt bundle: ${plan.promptBundle}`);
+  printHostedSecurityPlanRoute(out, "discovery", plan.routes.discovery);
+  printHostedSecurityPlanRoute(out, "validation", plan.routes.validation);
+  out.log(`  independent validation: ${plan.independent ? "yes" : "no"}`);
+  out.log("  source disclosure: bounded best-effort credential-pattern-redacted snippets may be sent through odla.ai to the selected providers");
+  out.log(`  retained report: model-derived prose and repository-relative paths for up to ${plan.reportRetentionDays} days; treat it as sensitive`);
+  out.log("  target execution: disabled");
+  out.log(`  to approve this exact plan, run security run --source <id> --plan-digest ${plan.planDigest} --ack-redacted-source`);
+}
+function printHostedSecurityIntent(out, intent) {
+  out.log(`Hosted security execution intent for ${intent.appId}/${intent.env}:`);
+  out.log(`  execution digest: ${intent.executionDigest}`);
+  out.log(`  contract: ${intent.executionContract}`);
+  out.log(`  source: ${intent.repository} (${intent.sourceId})`);
+  out.log(`  ref: ${intent.requestedRef ?? `default branch (${intent.defaultBranch})`}`);
+  out.log(`  profile: ${intent.profile}`);
+  out.log(`  disclosure: ${intent.sourceDisclosure} \xB7 plan ${intent.planDigest}`);
+}
+function assertHostedSecurityPlanReady(plan) {
+  const reasons = [];
+  for (const [label, route] of Object.entries(plan.routes)) {
+    if (!route.enabled) reasons.push(`${label} is disabled`);
+    if (!route.credentialReady) reasons.push(`${label} provider credential is unavailable`);
+  }
+  if (!plan.independent) reasons.push("discovery and validation are not independently routed");
+  if (plan.ready && reasons.length === 0) return;
+  if (!plan.ready && reasons.length === 0) reasons.push("the platform marked the plan unavailable");
+  throw new Error(`hosted security is not ready${reasons.length ? `: ${reasons.join("; ")}` : ""}. Ask a platform admin to update System AI security policy or credentials`);
+}
+function printHostedJob(out, job, platform, appId) {
+  out.log(`security job ${job.jobId}: ${job.status}`);
+  out.log(`  source: ${job.repository} ${job.requestedRef ?? "default"} -> ${job.commitSha ?? "resolving"}`);
+  if (job.routes) {
+    out.log(`  discovery: ${routeLabel(job.routes.discovery)}`);
+    out.log(`  validation: ${routeLabel(job.routes.validation)}`);
+  } else {
+    out.log("  routes: platform System AI policy (assigned when analysis starts)");
+  }
+  out.log(`  disclosure: ${job.sourceDisclosure} snippets \xB7 metadata retained up to ${job.retentionDays} days`);
+  out.log(`  consent: plan ${job.planDigest} \xB7 execution ${job.executionDigest} (${job.executionContract})`);
+  if (job.coverageStatus || job.coverage) printHostedCoverage(out, job);
+  if (job.counts) {
+    out.log(`  findings: confirmed=${job.counts.confirmed} needs_reproduction=${job.counts.needsReproduction} candidates=${job.counts.candidates}`);
+  }
+  if (job.errorCode) out.log(`  failure: ${job.errorCode}`);
+  const url = new URL("/studio", platform);
+  url.searchParams.set("app", appId);
+  url.searchParams.set("env", job.env);
+  url.searchParams.set("tab", "security");
+  url.searchParams.set("job", job.jobId);
+  out.log(`  Studio: ${url.toString()}`);
+}
+function printHostedReport(out, report) {
+  out.log(`security report ${report.jobId}: ${report.repository}@${report.revision}`);
+  out.log(`  coverage: ${report.coverageStatus} cells=${report.metrics.coverageCells} shallow=${report.metrics.shallowCells} blocked=${report.metrics.blockedCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates} rejected=${report.metrics.rejected}`);
+  out.log(`  discovery: ${report.provenance.discovery?.provider ?? "unknown"}/${report.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report.provenance.validation?.provider ?? "unknown"}/${report.provenance.validation?.model ?? "unknown"} independent=${String(report.provenance.independentValidation)}`);
+  for (const finding of report.findings) {
+    const location = finding.locations[0];
+    out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
+  }
+  for (const limitation of report.limitations) out.log(`  limitation: ${limitation}`);
+}
+function enforceHostedReportGate(report, parsed, out, emitSuccess) {
+  const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
+  const candidateValue = parsed.options["fail-on-candidates"];
+  const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
+  const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
+  const confirmed = report.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  if (confirmed.length || leads.length || incomplete) {
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report.coverageStatus}` : ""}`);
+  }
+  if (emitSuccess) {
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report.coverageStatus}. This is not proof that the application is secure.`);
+  }
+}
+function printHostedSecurityPlanRoute(out, label, route) {
+  const readiness = route.enabled && route.credentialReady ? "ready" : [
+    route.enabled ? void 0 : "disabled",
+    route.credentialReady ? void 0 : "credential unavailable"
+  ].filter(Boolean).join(", ");
+  out.log(`  ${label}: ${route.provider}/${route.model} \xB7 policy v${route.policyVersion} \xB7 ${readiness}`);
+  out.log(`    bounds: ${route.maxCallsPerRun} calls/run \xB7 ${route.maxInputBytes} input bytes/call \xB7 ${route.maxOutputTokens} output tokens/call`);
+}
+function printHostedCoverage(out, job) {
+  const coverage = job.coverage;
+  out.log(`  coverage: ${job.coverageStatus ?? "pending"}${coverage?.completeCells !== void 0 ? ` ${coverage.completeCells}/${coverage.totalCells ?? "?"}` : ""}${coverage?.shallowCells ? ` shallow=${coverage.shallowCells}` : ""}${coverage?.blockedCells ? ` blocked=${coverage.blockedCells}` : ""}${coverage?.unscheduledCells ? ` unscheduled=${coverage.unscheduledCells}` : ""}${coverage?.budgetExhaustedCells ? ` budget_exhausted=${coverage.budgetExhaustedCells}` : ""}`);
+}
+function routeLabel(route) {
+  return `${route.provider}/${route.model}${route.policyVersion ? ` policy v${route.policyVersion}` : ""}`;
+}
+var HOSTED_SEVERITIES = ["informational", "low", "medium", "high", "critical"];
+function hostedSeverity(value, flag) {
+  if (HOSTED_SEVERITIES.includes(value)) {
+    return value;
+  }
+  throw new Error(`${flag} must be informational, low, medium, high, or critical`);
+}
+
+// src/security-run-command.ts
+var import_security2 = require("@odla-ai/security");
+
 // src/security.ts
 var import_node_path6 = require("path");
 var import_security = require("@odla-ai/security");
@@ -1756,60 +2126,646 @@ function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
 }
 
-// src/help.ts
-var import_node_fs7 = require("fs");
-function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs7.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
-  return pkg.version ?? "unknown";
+// src/security-hosted-github.ts
+var import_node_child_process4 = require("child_process");
+var import_node_util = require("util");
+
+// src/security-hosted-request.ts
+async function requestHostedSecurityJson(options, path, init, action) {
+  const platform = platformAudience(options.platform);
+  const token = hostedSecurityCredential(options.token);
+  const requestInit = {
+    ...init,
+    redirect: "error",
+    credentials: "omit",
+    cache: "no-store",
+    signal: options.signal,
+    headers: {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      ...init.headers
+    }
+  };
+  const response = await (options.fetch ?? fetch)(new URL(path, platform), requestInit);
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const code = optionalHostedText(body.error?.code, "error code", 128);
+    const message = optionalHostedText(body.error?.message, "error message", 300);
+    throw new Error(`${action} failed (${response.status})${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`);
+  }
+  return body;
+}
+function hostedIdentifier(value, name) {
+  const result = optionalHostedText(value, name, 180);
+  if (!result || !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(result)) {
+    throw new Error(`${name} is invalid`);
+  }
+  return result;
+}
+function positivePolicyVersion(value, name) {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new Error(`${name} is invalid`);
+  }
+  return value;
+}
+function optionalHostedText(value, name, maxLength) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  if (typeof value !== "string" || value.length > maxLength || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`${name} is invalid`);
+  }
+  return value;
+}
+function githubRepositoryName(value) {
+  if (typeof value !== "string" || value.length > 201) {
+    throw new Error("repository must be owner/name");
+  }
+  const parts = value.split("/");
+  const owner = parts[0] ?? "";
+  const name = (parts[1] ?? "").replace(/\.git$/i, "");
+  if (parts.length !== 2 || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,98}[A-Za-z0-9])?$/.test(owner) || !/^[A-Za-z0-9_.-]{1,100}$/.test(name) || name === "." || name === "..") {
+    throw new Error("repository must be owner/name");
+  }
+  return `${owner}/${name}`;
+}
+function trustedGitHubInstallUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("odla.ai returned an invalid GitHub installation URL");
+  }
+  if (url.protocol !== "https:" || url.hostname !== "github.com" || url.username || url.password) {
+    throw new Error("odla.ai returned an untrusted GitHub installation URL");
+  }
+  return url.toString();
+}
+function hostedPollInterval(value = 2e3) {
+  if (!Number.isSafeInteger(value) || value < 100 || value > 3e4) {
+    throw new Error("poll interval must be 100-30000ms");
+  }
+  return value;
+}
+function hostedPollTimeout(value = 10 * 6e4) {
+  if (!Number.isSafeInteger(value) || value < 1e3 || value > 60 * 6e4) {
+    throw new Error("poll timeout must be 1000-3600000ms");
+  }
+  return value;
+}
+async function waitForHostedPoll(milliseconds, signal) {
+  if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
+  await new Promise((resolve7, reject) => {
+    const timer = setTimeout(resolve7, milliseconds);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      reject(signal.reason ?? new DOMException("aborted", "AbortError"));
+    }, { once: true });
+  });
+}
+function isValidHostedSecurityPlan(value, env) {
+  if (!value || value.env !== env || !/^sha256:[a-f0-9]{64}$/.test(value.planDigest) || value.consentContract !== "odla.hosted-security-consent.v1" || value.reportProjection !== "odla.hosted-security-report.v1" || value.redactionContract !== "odla.best-effort-credential-pattern-redaction.v1" || typeof value.promptBundle !== "string" || value.promptBundle.length < 1 || value.promptBundle.length > 100 || typeof value.ready !== "boolean" || typeof value.independent !== "boolean" || value.sourceDisclosure !== "redacted" || value.targetExecution !== false || !Number.isSafeInteger(value.reportRetentionDays) || value.reportRetentionDays < 1) return false;
+  const validRoute = (route, purpose) => !!route && route.purpose === purpose && typeof route.enabled === "boolean" && typeof route.credentialReady === "boolean" && typeof route.provider === "string" && route.provider.length > 0 && route.provider.length <= 100 && typeof route.model === "string" && route.model.length > 0 && route.model.length <= 200 && Number.isSafeInteger(route.policyVersion) && route.policyVersion >= 1 && Number.isSafeInteger(route.maxCallsPerRun) && route.maxCallsPerRun >= 1 && Number.isSafeInteger(route.maxInputBytes) && route.maxInputBytes >= 1 && Number.isSafeInteger(route.maxOutputTokens) && route.maxOutputTokens >= 1;
+  return validRoute(value.routes?.discovery, "security.discovery") && validRoute(value.routes?.validation, "security.validation");
+}
+function hostedSecurityCredential(value) {
+  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error("Hosted security requires an injected odla developer token");
+  }
+  return value;
 }
-function printHelp() {
-  console.log(`odla-ai
 
-Usage:
-  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
-  odla-ai doctor [--config odla.config.mjs]
-  odla-ai capabilities [--json]
-  odla-ai admin ai show [--platform https://odla.ai] [--json]
-  odla-ai admin ai models [--provider <id>] [--json]
-  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
-  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
-    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]
-  odla-ai admin ai credentials [--json]
-  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
-  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
-  odla-ai admin ai audit [--limit <1-200>] [--json]
-  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
-  odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev]
-  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai version
+// src/security-hosted-github.ts
+async function connectGitHubSecuritySource(options) {
+  const out = options.stdout ?? console;
+  const repository = githubRepositoryName(options.repository);
+  const attempt = await requestHostedSecurityJson(
+    options,
+    "/registry/github/connect",
+    {
+      method: "POST",
+      body: JSON.stringify({
+        appId: hostedIdentifier(options.appId, "appId"),
+        env: hostedIdentifier(options.env, "env"),
+        repository
+      })
+    },
+    "start GitHub connection"
+  );
+  const serverExpiry = Date.parse(attempt?.expiresAt ?? "");
+  if (!attempt?.attemptId || !attempt.installUrl || !Number.isFinite(serverExpiry)) {
+    throw new Error("odla.ai returned an invalid GitHub connection attempt");
+  }
+  const installUrl = trustedGitHubInstallUrl(attempt.installUrl);
+  out.log(`GitHub approval: ${installUrl}`);
+  if (options.open !== false) {
+    await (options.openInstallUrl ?? openUrl)(installUrl);
+    out.log("github: opened installation approval in your browser");
+  }
+  const interval = hostedPollInterval(options.pollIntervalMs);
+  const now = options.now ?? Date.now;
+  const deadline = Math.min(serverExpiry, now() + hostedPollTimeout(options.pollTimeoutMs));
+  const wait = options.wait ?? waitForHostedPoll;
+  while (true) {
+    const state = await requestHostedSecurityJson(
+      options,
+      `/registry/github/connect/${encodeURIComponent(attempt.attemptId)}`,
+      {},
+      "check GitHub connection"
+    );
+    if (state.status !== "pending") {
+      if (state.status === "connected") return state;
+      throw new Error(`GitHub connection ${state.status}${state.failureCode ? `: ${state.failureCode}` : ""}`);
+    }
+    if (now() >= deadline) throw new Error("GitHub connection approval timed out");
+    await wait(Math.min(interval, Math.max(0, deadline - now())), options.signal);
+  }
+}
+async function listGitHubSecuritySources(options) {
+  const appId = hostedIdentifier(options.appId, "appId");
+  const env = hostedIdentifier(options.env, "env");
+  const body = await requestHostedSecurityJson(
+    options,
+    `/registry/apps/${encodeURIComponent(appId)}/github/sources?env=${encodeURIComponent(env)}`,
+    {},
+    "list GitHub security sources"
+  );
+  return Array.isArray(body.sources) ? body.sources : [];
+}
+async function disconnectGitHubSecuritySource(options) {
+  const appId = hostedIdentifier(options.appId, "appId");
+  const sourceId = hostedIdentifier(options.sourceId, "sourceId");
+  await requestHostedSecurityJson(
+    options,
+    `/registry/apps/${encodeURIComponent(appId)}/github/sources/${encodeURIComponent(sourceId)}`,
+    { method: "DELETE" },
+    "disconnect GitHub security source"
+  );
+}
+function repositoryFromGitRemote(remoteInput) {
+  const remote = remoteInput.trim();
+  const scp = /^git@github\.com:([^/\s]+)\/([^/\s]+?)\/?$/.exec(remote);
+  if (scp) return githubRepositoryName(`${scp[1]}/${scp[2].replace(/\.git$/, "")}`);
+  let url;
+  try {
+    url = new URL(remote);
+  } catch {
+    throw new Error("origin must be a github.com HTTPS or SSH repository URL");
+  }
+  if (url.hostname !== "github.com" || url.protocol !== "https:" && url.protocol !== "ssh:") {
+    throw new Error("origin must be a github.com HTTPS or SSH repository URL");
+  }
+  if (url.password || url.protocol === "https:" && url.username || url.search || url.hash) {
+    throw new Error("credential-bearing GitHub origin URLs are not accepted");
+  }
+  const parts = url.pathname.replace(/^\/+|\/+$/g, "").split("/");
+  if (parts.length !== 2) {
+    throw new Error("origin must identify one GitHub owner/name repository");
+  }
+  return githubRepositoryName(`${parts[0]}/${parts[1].replace(/\.git$/, "")}`);
+}
+async function inferGitHubRepository(cwd = process.cwd(), readOrigin = defaultReadOrigin) {
+  let remote;
+  try {
+    remote = await readOrigin(cwd);
+  } catch {
+    throw new Error("Could not read git origin; pass --repo owner/name");
+  }
+  return repositoryFromGitRemote(remote);
+}
+async function defaultReadOrigin(cwd) {
+  const result = await (0, import_node_util.promisify)(import_node_child_process4.execFile)(
+    "git",
+    ["remote", "get-url", "origin"],
+    { cwd, encoding: "utf8" }
+  );
+  return result.stdout;
+}
 
-Commands:
-  setup        Install offline odla runbooks for common coding-agent harnesses.
-  init         Create a generic odla.config.mjs plus starter schema/rules files.
-  doctor       Validate and summarize the project config without network calls.
-  capabilities Show what the CLI automates vs agent edits and human checkpoints.
-  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
-  security     Run hosted discovery + independent validation with app/run attribution.
-  provision    Register services, configure them, persist credentials, optionally push secrets.
-  smoke        Verify local credentials, public-config, live schema, and db aggregate.
-  skill        Same installer; --agent accepts all, claude, codex, cursor,
-               copilot, gemini, or agents (repeatable or comma-separated).
-  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.
-  version      Print the CLI version.
+// src/security-hosted-intent.ts
+async function getHostedSecurityIntent(options) {
+  const appId = hostedIdentifier(options.appId, "appId");
+  const env = hostedIdentifier(options.env, "env");
+  const sourceId = hostedIdentifier(options.sourceId, "sourceId");
+  const ref = optionalHostedText(options.ref, "ref", 255);
+  const query = new URLSearchParams({ env, sourceId });
+  if (ref) query.set("ref", ref);
+  if (options.profile) query.set("profile", options.profile);
+  const response = await requestHostedSecurityJson(
+    options,
+    `/registry/apps/${encodeURIComponent(appId)}/security/intent?${query.toString()}`,
+    {},
+    "read hosted security execution intent"
+  );
+  if (!isValidHostedSecurityPlan(response.plan, env) || !isValidIntent(response.intent, { appId, env, sourceId })) {
+    throw new Error("odla.ai returned an invalid hosted security execution intent");
+  }
+  if (response.intent.planDigest !== response.plan.planDigest) {
+    throw new Error("odla.ai returned a hosted security intent for a different processing plan");
+  }
+  return response;
+}
+function isValidIntent(value, expected) {
+  return !!value && value.executionContract === "odla.hosted-security-execution-consent.v1" && /^sha256:[a-f0-9]{64}$/.test(value.executionDigest) && /^sha256:[a-f0-9]{64}$/.test(value.planDigest) && value.appId === expected.appId && value.env === expected.env && value.sourceId === expected.sourceId && typeof value.repository === "string" && value.repository.length > 2 && value.repository.length <= 201 && typeof value.defaultBranch === "string" && value.defaultBranch.length > 0 && value.defaultBranch.length <= 255 && typeof value.requestedRef === "string" && value.requestedRef.length > 0 && value.requestedRef.length <= 255 && !/[\u0000-\u001f\u007f]/.test(value.requestedRef) && ["odla", "cloudflare-app", "generic"].includes(value.profile) && value.sourceDisclosure === "redacted";
+}
 
-Safety:
-  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
-  --yes to provision it; use --dry-run first to inspect the resolved plan.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
-  Provision opens the approval page automatically in interactive terminals;
-  use --open to force browser launch or --no-open to suppress it.
-`);
+// src/security-hosted-jobs.ts
+async function getHostedSecurityPlan(options) {
+  const appId = hostedIdentifier(options.appId, "appId");
+  const env = hostedIdentifier(options.env, "env");
+  const plan = await requestHostedSecurityJson(
+    options,
+    `/registry/apps/${encodeURIComponent(appId)}/security/plan?env=${encodeURIComponent(env)}`,
+    {},
+    "read hosted security disclosure plan"
+  );
+  if (!isValidHostedSecurityPlan(plan, env)) {
+    throw new Error("odla.ai returned an invalid hosted security disclosure plan");
+  }
+  return plan;
+}
+async function startHostedSecurityJob(options) {
+  if (options.sourceDisclosureAck !== "redacted") {
+    throw new Error("Hosted GitHub security requires sourceDisclosureAck=redacted; repository access alone is not disclosure consent");
+  }
+  const appId = hostedIdentifier(options.appId, "appId");
+  const env = hostedIdentifier(options.env, "env");
+  const sourceId = hostedIdentifier(options.sourceId, "sourceId");
+  const ref = optionalHostedText(options.ref, "ref", 255);
+  const expectedPlanDigest = securityPlanDigest(options.expectedPlanDigest);
+  const expectedExecutionDigest = securityExecutionDigest(options.expectedExecutionDigest);
+  const expectedPolicyVersions = {
+    discovery: positivePolicyVersion(
+      options.expectedPolicyVersions?.discovery,
+      "expected discovery policy version"
+    ),
+    validation: positivePolicyVersion(
+      options.expectedPolicyVersions?.validation,
+      "expected validation policy version"
+    )
+  };
+  let body;
+  try {
+    body = await requestHostedSecurityJson(
+      options,
+      `/registry/apps/${encodeURIComponent(appId)}/security/jobs`,
+      {
+        method: "POST",
+        body: JSON.stringify({
+          env,
+          sourceId,
+          ...ref ? { ref } : {},
+          ...options.profile ? { profile: options.profile } : {},
+          ...options.clientRequestId ? { clientRequestId: hostedIdentifier(options.clientRequestId, "clientRequestId") } : {},
+          sourceDisclosure: "redacted",
+          expectedPlanDigest,
+          expectedExecutionDigest,
+          expectedPolicyVersions
+        })
+      },
+      "start hosted security job"
+    );
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/\b(?:plan_conflict|policy_conflict|intent_conflict|security_ai_not_ready)\b/.test(message)) {
+      throw new Error("Hosted security plan or execution intent changed or became unavailable after review; fetch a fresh intent and explicitly acknowledge its digest before enqueueing again", { cause: error });
+    }
+    throw error;
+  }
+  if (!body.job?.jobId) {
+    throw new Error("odla.ai returned an invalid hosted security job");
+  }
+  return body.job;
+}
+async function getHostedSecurityJob(options) {
+  const body = await requestHostedSecurityJson(
+    options,
+    hostedJobPath(options.appId, options.jobId),
+    {},
+    "read hosted security job"
+  );
+  if (!body.job?.jobId) throw new Error("odla.ai returned an invalid hosted security job");
+  return body.job;
+}
+async function followHostedSecurityJob(options) {
+  const interval = hostedPollInterval(options.pollIntervalMs);
+  const now = options.now ?? Date.now;
+  const deadline = now() + hostedPollTimeout(options.pollTimeoutMs ?? 60 * 6e4);
+  const wait = options.wait ?? waitForHostedPoll;
+  let prior = "";
+  while (true) {
+    const job = await getHostedSecurityJob(options);
+    const fingerprint = `${job.status}:${job.updatedAt}`;
+    if (fingerprint !== prior) options.onUpdate?.(Object.freeze({ ...job }));
+    prior = fingerprint;
+    if (isTerminalHostedSecurityStatus(job.status)) return job;
+    if (now() >= deadline) {
+      throw new Error(`Hosted security job ${job.jobId} did not finish before the polling deadline`);
+    }
+    await wait(Math.min(interval, Math.max(0, deadline - now())), options.signal);
+  }
+}
+async function getHostedSecurityReport(options) {
+  return requestHostedSecurityJson(
+    options,
+    `${hostedJobPath(options.appId, options.jobId)}/report`,
+    {},
+    "read hosted security report"
+  );
+}
+function isTerminalHostedSecurityStatus(status) {
+  return status === "completed" || status === "failed" || status === "cancelled";
+}
+function hostedJobPath(appIdInput, jobIdInput) {
+  const appId = hostedIdentifier(appIdInput, "appId");
+  const jobId = hostedIdentifier(jobIdInput, "jobId");
+  return `/registry/apps/${encodeURIComponent(appId)}/security/jobs/${encodeURIComponent(jobId)}`;
+}
+function securityPlanDigest(value) {
+  if (!/^sha256:[a-f0-9]{64}$/.test(value)) {
+    throw new Error("expected plan digest must be a sha256 digest from security plan");
+  }
+  return value;
+}
+function securityExecutionDigest(value) {
+  if (!/^sha256:[a-f0-9]{64}$/.test(value)) {
+    throw new Error("expected execution digest must be a sha256 digest from security intent");
+  }
+  return value;
+}
+
+// src/security-run-command.ts
+async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
+  assertArgs(parsed, [
+    "config",
+    "env",
+    "profile",
+    "platform",
+    "source",
+    "ref",
+    "follow",
+    "open",
+    "json",
+    "ack-redacted-source",
+    "plan-digest",
+    "fail-on",
+    "fail-on-candidates",
+    "allow-incomplete"
+  ], 2);
+  const follow = parsed.options.follow !== false;
+  if (!follow && (parsed.options["fail-on"] !== void 0 || parsed.options["fail-on-candidates"] !== void 0 || parsed.options["allow-incomplete"] !== void 0)) {
+    throw new Error("hosted security gate options require following the job; remove --no-follow");
+  }
+  const acknowledgedDigest = requiredString(parsed.options["plan-digest"], "--plan-digest");
+  const context = await hostedSecurityContext(parsed, dependencies);
+  const plan = await getHostedSecurityPlan(context);
+  if (parsed.options.json !== true) printHostedSecurityPlan(context.stdout, plan, context.appId);
+  assertHostedSecurityPlanReady(plan);
+  if (acknowledgedDigest !== plan.planDigest) {
+    throw new Error(`--plan-digest does not match the current hosted security plan (${plan.planDigest}); review and explicitly acknowledge the current digest`);
+  }
+  const requestedRef = stringOpt(parsed.options.ref);
+  const requestedProfile = securityProfile(stringOpt(parsed.options.profile));
+  const preview = await getHostedSecurityIntent({
+    ...context,
+    sourceId,
+    ref: requestedRef,
+    profile: requestedProfile
+  });
+  if (parsed.options.json !== true) printHostedSecurityIntent(context.stdout, preview.intent);
+  if (preview.plan.planDigest !== plan.planDigest || preview.intent.planDigest !== plan.planDigest) {
+    throw new Error(`hosted security plan changed while previewing execution (${preview.plan.planDigest}); review and explicitly acknowledge the current plan digest`);
+  }
+  const job = await startHostedSecurityJob({
+    ...context,
+    sourceId,
+    ref: requestedRef,
+    profile: requestedProfile,
+    clientRequestId: crypto.randomUUID(),
+    sourceDisclosureAck: parsed.options["ack-redacted-source"] === true ? "redacted" : void 0,
+    expectedPlanDigest: plan.planDigest,
+    expectedExecutionDigest: preview.intent.executionDigest,
+    expectedPolicyVersions: {
+      discovery: plan.routes.discovery.policyVersion,
+      validation: plan.routes.validation.policyVersion
+    }
+  });
+  const result = follow ? await followHostedSecurityJob({
+    ...context,
+    jobId: job.jobId,
+    wait: dependencies.pollWait,
+    onUpdate: parsed.options.json === true ? void 0 : (value) => printHostedJob(context.stdout, value, context.platform, context.appId)
+  }) : job;
+  if (!follow) {
+    if (parsed.options.json === true) {
+      context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result }, null, 2));
+    } else {
+      printHostedJob(context.stdout, result, context.platform, context.appId);
+    }
+    return;
+  }
+  if (result.status !== "completed") {
+    if (parsed.options.json === true) {
+      context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result }, null, 2));
+    }
+    throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
+  }
+  const report = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  if (parsed.options.json === true) {
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report }, null, 2));
+  } else {
+    printHostedReport(context.stdout, report);
+  }
+  enforceHostedReportGate(report, parsed, context.stdout, parsed.options.json !== true);
+}
+async function runLocalSecurityCommand(parsed, dependencies) {
+  if (parsed.options.source === true) {
+    throw new Error("--source requires a source id; run security sources first");
+  }
+  assertArgs(parsed, [
+    "config",
+    "env",
+    "out",
+    "profile",
+    "max-hunt-tasks",
+    "run-id",
+    "platform",
+    "self",
+    "ack-redacted-source",
+    "open",
+    "fail-on",
+    "fail-on-candidates",
+    "allow-incomplete"
+  ], 3);
+  const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+  const selfAudit = parsed.options.self === true;
+  const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
+  const platform = stringOpt(parsed.options.platform);
+  const doFetch = dependencies.fetch ?? fetch;
+  const out = dependencies.stdout ?? console;
+  const result = await runHostedSecurity({
+    configPath,
+    selfAudit,
+    target: parsed.positionals[2],
+    out: stringOpt(parsed.options.out),
+    env: stringOpt(parsed.options.env),
+    profile: securityProfile(stringOpt(parsed.options.profile)),
+    maxHuntTasks: numberOpt(parsed.options["max-hunt-tasks"], "--max-hunt-tasks"),
+    runId: stringOpt(parsed.options["run-id"]),
+    platform,
+    sourceDisclosureAck: parsed.options["ack-redacted-source"] === true ? "redacted" : void 0,
+    fetch: doFetch,
+    stdout: out,
+    getToken: async (request) => {
+      if (request.scope === "platform:security:self") {
+        return getScopedPlatformToken({
+          platform: request.platform,
+          scope: request.scope,
+          open,
+          fetch: doFetch,
+          stdout: out,
+          openApprovalUrl: dependencies.openUrl
+        });
+      }
+      const cfg = await loadProjectConfig(configPath);
+      if (platformAudience(cfg.platformUrl) !== platformAudience(request.platform)) {
+        throw new Error("--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there");
+      }
+      return getDeveloperToken(
+        cfg,
+        { configPath, open, openApprovalUrl: dependencies.openUrl },
+        doFetch,
+        out
+      );
+    }
+  });
+  enforceLocalGate(result.report, parsed);
+}
+function enforceLocalGate(report, parsed) {
+  const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
+  const candidateValue = parsed.options["fail-on-candidates"];
+  const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
+  const confirmed = (0, import_security2.findingsAtOrAbove)(report, failOn);
+  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  if (confirmed.length || leads.length || incomplete) {
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
+  }
+}
+function severityOpt(value, flag) {
+  if (["informational", "low", "medium", "high", "critical"].includes(value)) {
+    return value;
+  }
+  throw new Error(`${flag} must be informational, low, medium, high, or critical`);
+}
+
+// src/security-command.ts
+async function securityCommand(parsed, dependencies) {
+  const sub = parsed.positionals[1];
+  if (sub === "github") {
+    await githubSecurityCommand(parsed, dependencies);
+    return;
+  }
+  if (sub === "plan") {
+    assertArgs(parsed, ["config", "env", "platform", "open", "json"], 2);
+    const context = await hostedSecurityContext(parsed, dependencies);
+    const plan = await getHostedSecurityPlan(context);
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(plan, null, 2));
+    else printHostedSecurityPlan(context.stdout, plan, context.appId);
+    return;
+  }
+  if (sub === "sources") {
+    await listSecuritySources(parsed, dependencies);
+    return;
+  }
+  if (sub === "status") {
+    await securityStatus(parsed, dependencies);
+    return;
+  }
+  if (sub === "report") {
+    assertArgs(parsed, ["config", "env", "platform", "open", "json"], 3);
+    const jobId = requiredSecurityPositional(parsed, 2, "job id");
+    const context = await hostedSecurityContext(parsed, dependencies);
+    const report = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report, null, 2));
+    else printHostedReport(context.stdout, report);
+    return;
+  }
+  if (sub !== "run") {
+    throw new Error('unknown security command. Try "odla-ai security plan", "security sources", or "security run".');
+  }
+  const sourceId = stringOpt(parsed.options.source);
+  if (sourceId) await runSourceSecurityCommand(parsed, dependencies, sourceId);
+  else await runLocalSecurityCommand(parsed, dependencies);
+}
+async function githubSecurityCommand(parsed, dependencies) {
+  const action = parsed.positionals[2];
+  if (action === "disconnect") {
+    assertArgs(parsed, ["config", "env", "platform", "source", "open", "yes"], 3);
+    const context2 = await hostedSecurityContext(parsed, dependencies);
+    const sourceId = requiredString(parsed.options.source, "--source");
+    const confirmed = parsed.options.yes === true || await interactiveConfirmation(
+      `Disconnect GitHub security source ${sourceId} from ${context2.appId}/${context2.env}?`,
+      dependencies
+    );
+    if (!confirmed) {
+      throw new Error("GitHub source disconnect cancelled; pass --yes in a non-interactive shell");
+    }
+    await disconnectGitHubSecuritySource({ ...context2, sourceId });
+    context2.stdout.log(`github: disconnected ${sourceId} from ${context2.appId}/${context2.env}`);
+    return;
+  }
+  if (action !== "connect") {
+    throw new Error('unknown security github command. Try "odla-ai security github connect".');
+  }
+  assertArgs(parsed, ["config", "env", "platform", "repo", "open"], 3);
+  const context = await hostedSecurityContext(parsed, dependencies);
+  const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin);
+  const connection = await connectGitHubSecuritySource({
+    ...context,
+    repository,
+    open: parsed.options.open !== false,
+    openInstallUrl: dependencies.openUrl ?? openUrl,
+    wait: dependencies.pollWait,
+    stdout: context.stdout
+  });
+  context.stdout.log(`github: connected ${connection.repository ?? repository} (${connection.sourceId ?? "source pending"})`);
+  context.stdout.log("github: odla.ai stores the installation; no PAT or GitHub token is written locally");
+}
+async function listSecuritySources(parsed, dependencies) {
+  assertArgs(parsed, ["config", "env", "platform", "open", "json"], 2);
+  const context = await hostedSecurityContext(parsed, dependencies);
+  const [plan, sources] = await Promise.all([
+    getHostedSecurityPlan(context),
+    listGitHubSecuritySources(context)
+  ]);
+  if (parsed.options.json === true) {
+    context.stdout.log(JSON.stringify({ plan, sources }, null, 2));
+    return;
+  }
+  printHostedSecurityPlan(context.stdout, plan, context.appId);
+  if (!sources.length) {
+    context.stdout.log(`No GitHub security sources connected for ${context.appId}/${context.env}.`);
+    return;
+  }
+  context.stdout.log(`GitHub security sources for ${context.appId}/${context.env}
+source	repository	default ref	status`);
+  for (const source of sources) {
+    context.stdout.log(`${source.sourceId}	${source.repository}	${source.defaultBranch}	${source.status}`);
+  }
+}
+async function securityStatus(parsed, dependencies) {
+  assertArgs(parsed, ["config", "env", "platform", "open", "json", "follow"], 3);
+  const jobId = requiredSecurityPositional(parsed, 2, "job id");
+  const context = await hostedSecurityContext(parsed, dependencies);
+  const job = parsed.options.follow === true ? await followHostedSecurityJob({
+    ...context,
+    jobId,
+    wait: dependencies.pollWait,
+    onUpdate: parsed.options.json === true ? void 0 : (value) => printHostedJob(context.stdout, value, context.platform, context.appId)
+  }) : await getHostedSecurityJob({ ...context, jobId });
+  if (parsed.options.json === true) context.stdout.log(JSON.stringify(job, null, 2));
+  else if (parsed.options.follow !== true) {
+    printHostedJob(context.stdout, job, context.platform, context.appId);
+  }
 }
 
 // src/skill.ts
@@ -2147,7 +3103,7 @@ async function safeText3(res) {
 }
 
 // src/cli.ts
-async function runCli(argv = process.argv.slice(2)) {
+async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   const parsed = parseArgv(argv);
   const command = parsed.positionals[0] ?? "help";
   if (command === "version" || command === "-v" || parsed.options.version === true) {
@@ -2161,7 +3117,15 @@ async function runCli(argv = process.argv.slice(2)) {
     return;
   }
   if (command === "init") {
-    assertArgs(parsed, ["app-id", "name", "config", "env", "services", "ai-provider", "force"], 1);
+    assertArgs(parsed, [
+      "app-id",
+      "name",
+      "config",
+      "env",
+      "services",
+      "ai-provider",
+      "force"
+    ], 1);
     initProject({
       appId: requiredString(parsed.options["app-id"], "--app-id"),
       name: requiredString(parsed.options.name, "--name"),
@@ -2184,149 +3148,15 @@ async function runCli(argv = process.argv.slice(2)) {
     return;
   }
   if (command === "admin") {
-    const area = parsed.positionals[1];
-    const action = parsed.positionals[2];
-    const credentialSet = action === "credential" && parsed.positionals[3] === "set";
-    const credentials = action === "credentials";
-    const models = action === "models";
-    const usage = action === "usage";
-    const audit = action === "audit";
-    if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
-      throw new Error('unknown admin command. Try "odla-ai admin ai show".');
-    }
-    assertArgs(parsed, [
-      "platform",
-      "json",
-      "open",
-      "provider",
-      "model",
-      "enabled",
-      "max-input-bytes",
-      "max-output-tokens",
-      "max-calls-per-run",
-      "from-env",
-      "stdin",
-      "discovery-provider",
-      "discovery-model",
-      "validation-provider",
-      "validation-model",
-      "app-id",
-      "env",
-      "run-id",
-      "limit"
-    ], credentialSet ? 5 : action === "set" ? 4 : 3);
-    await adminAi({
-      action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
-      purpose: action === "set" ? parsed.positionals[3] : void 0,
-      provider: stringOpt(parsed.options.provider),
-      model: stringOpt(parsed.options.model),
-      enabled: boolOpt(parsed.options.enabled),
-      maxInputBytes: numberOpt(parsed.options["max-input-bytes"], "--max-input-bytes"),
-      maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
-      maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
-      platform: stringOpt(parsed.options.platform),
-      json: parsed.options.json === true,
-      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-      credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
-      fromEnv: stringOpt(parsed.options["from-env"]),
-      stdin: parsed.options.stdin === true,
-      discoveryProvider: stringOpt(parsed.options["discovery-provider"]),
-      discoveryModel: stringOpt(parsed.options["discovery-model"]),
-      validationProvider: stringOpt(parsed.options["validation-provider"]),
-      validationModel: stringOpt(parsed.options["validation-model"]),
-      appId: stringOpt(parsed.options["app-id"]),
-      env: stringOpt(parsed.options.env),
-      runId: stringOpt(parsed.options["run-id"]),
-      limit: numberOpt(parsed.options.limit, "--limit")
-    });
+    await adminCommand(parsed);
     return;
   }
   if (command === "security") {
-    const sub = parsed.positionals[1];
-    if (sub !== "run") throw new Error('unknown security command. Try "odla-ai security run".');
-    assertArgs(parsed, [
-      "config",
-      "env",
-      "out",
-      "profile",
-      "max-hunt-tasks",
-      "run-id",
-      "platform",
-      "self",
-      "ack-redacted-source",
-      "open",
-      "fail-on",
-      "fail-on-candidates",
-      "allow-incomplete"
-    ], 3);
-    const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
-    const selfAudit = parsed.options.self === true;
-    const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
-    const platform = stringOpt(parsed.options.platform);
-    const result = await runHostedSecurity({
-      configPath,
-      selfAudit,
-      target: parsed.positionals[2],
-      out: stringOpt(parsed.options.out),
-      env: stringOpt(parsed.options.env),
-      profile: securityProfile(stringOpt(parsed.options.profile)),
-      maxHuntTasks: numberOpt(parsed.options["max-hunt-tasks"], "--max-hunt-tasks"),
-      runId: stringOpt(parsed.options["run-id"]),
-      platform,
-      sourceDisclosureAck: parsed.options["ack-redacted-source"] === true ? "redacted" : void 0,
-      getToken: async (request) => {
-        if (request.scope === "platform:security:self") {
-          return getScopedPlatformToken({ platform: request.platform, scope: request.scope, open });
-        }
-        const cfg = await loadProjectConfig(configPath);
-        if (platformAudience(cfg.platformUrl) !== platformAudience(request.platform)) {
-          throw new Error("--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there");
-        }
-        return getDeveloperToken(cfg, { configPath, open }, fetch, console);
-      }
-    });
-    const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
-    const candidateValue = parsed.options["fail-on-candidates"];
-    const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-    const confirmed = (0, import_security2.findingsAtOrAbove)(result.report, failOn);
-    const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(result.report, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-    const incomplete = result.report.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
-    if (confirmed.length || leads.length || incomplete) {
-      throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
-    }
+    await securityCommand(parsed, dependencies);
     return;
   }
   if (command === "provision") {
-    assertArgs(
-      parsed,
-      [
-        "config",
-        "dry-run",
-        "rotate-keys",
-        "rotate-o11y-token",
-        "push-secrets",
-        "write-credentials",
-        "write-dev-vars",
-        "token",
-        "open",
-        "yes"
-      ],
-      1
-    );
-    const writeDevVars2 = parsed.options["write-dev-vars"];
-    const opts = {
-      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
-      dryRun: parsed.options["dry-run"] === true,
-      rotateKeys: parsed.options["rotate-keys"] === true,
-      rotateO11yToken: parsed.options["rotate-o11y-token"] === true,
-      pushSecrets: parsed.options["push-secrets"] === true,
-      writeCredentials: parsed.options["write-credentials"] !== false,
-      writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
-      token: stringOpt(parsed.options.token),
-      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-      yes: parsed.options.yes === true
-    };
-    await provision(opts);
+    await provisionCommand(parsed);
     return;
   }
   if (command === "smoke") {
@@ -2352,7 +3182,9 @@ async function runCli(argv = process.argv.slice(2)) {
   }
   if (command === "skill") {
     const sub = parsed.positionals[1];
-    if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
+    if (sub !== "install") {
+      throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
+    }
     assertArgs(parsed, ["dir", "global", "force", "agent", "harness"], 2);
     installSkill({
       dir: stringOpt(parsed.options.dir),
@@ -2364,7 +3196,27 @@ async function runCli(argv = process.argv.slice(2)) {
   }
   if (command === "secrets") {
     const sub = parsed.positionals[1];
-    if (sub !== "push") throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
+    if (sub === "set" || sub === "set-clerk-key") {
+      assertArgs(parsed, ["config", "env", "from-env", "stdin", "token", "yes"], sub === "set" ? 3 : 2);
+      const options = {
+        configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+        name: parsed.positionals[2],
+        env: requiredString(parsed.options.env, "--env"),
+        fromEnv: stringOpt(parsed.options["from-env"]),
+        stdin: parsed.options.stdin === true,
+        token: stringOpt(parsed.options.token),
+        yes: parsed.options.yes === true,
+        fetch: dependencies.fetch,
+        stdout: dependencies.stdout
+      };
+      await (sub === "set" ? secretsSet(options) : secretsSetClerkKey(options));
+      return;
+    }
+    if (sub !== "push") {
+      throw new Error(
+        `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
+      );
+    }
     assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
     await secretsPush({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
@@ -2376,29 +3228,33 @@ async function runCli(argv = process.argv.slice(2)) {
   }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
-function securityProfile(value) {
-  if (value === void 0) return void 0;
-  if (value === "odla" || value === "cloudflare-app" || value === "generic") return value;
-  throw new Error("--profile must be odla, cloudflare-app, or generic");
-}
-function severityOpt(value, flag) {
-  if (["informational", "low", "medium", "high", "critical"].includes(value)) return value;
-  throw new Error(`${flag} must be informational, low, medium, high, or critical`);
-}
-function harnessList(parsed) {
-  const selected = [
-    ...harnessOption(parsed.options.agent, "--agent"),
-    ...harnessOption(parsed.options.harness, "--harness")
-  ];
-  return selected.length ? selected : ["all"];
-}
-function harnessOption(value, flag) {
-  if (value === void 0) return [];
-  if (typeof value === "boolean") throw new Error(`${flag} requires a harness name`);
-  const raw = Array.isArray(value) ? value : [value];
-  const parts = raw.flatMap((item) => item.split(","));
-  if (parts.some((item) => !item.trim())) throw new Error(`${flag} requires a harness name`);
-  return parts.map((item) => item.trim());
+async function provisionCommand(parsed) {
+  assertArgs(parsed, [
+    "config",
+    "dry-run",
+    "rotate-keys",
+    "rotate-o11y-token",
+    "push-secrets",
+    "write-credentials",
+    "write-dev-vars",
+    "token",
+    "open",
+    "yes"
+  ], 1);
+  const writeDevVars2 = parsed.options["write-dev-vars"];
+  const options = {
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    dryRun: parsed.options["dry-run"] === true,
+    rotateKeys: parsed.options["rotate-keys"] === true,
+    rotateO11yToken: parsed.options["rotate-o11y-token"] === true,
+    pushSecrets: parsed.options["push-secrets"] === true,
+    writeCredentials: parsed.options["write-credentials"] !== false,
+    writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
+    token: stringOpt(parsed.options.token),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    yes: parsed.options.yes === true
+  };
+  await provision(options);
 }
 
 // src/bin.ts