@pebblehouse/odin-cli 0.16.0 → 0.18.0

package/README.md

@@ -65,6 +65,14 @@ odin search "authentication"                  # Cross-pebble
 odin search "RLS policies" --pebble odin      # Scoped
 ```
 
+### Tickets
+
+```bash
+odin tickets resolve ODIN-12                  # Resolve a ticket key to its bet or task
+odin tasks promote <slug> <task-id> --file ./bet.md   # Promote a task to a bet (keeps its ticket ID)
+odin tasks create <slug> "Fix" --follow-up-of ODIN-12 # Allocate ODIN-12A as a follow-up
+```
+
 ### Auth
 
 ```bash

package/dist/index.js

@@ -1,12 +1,23 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command23 } from "commander";
+import { Command as Command24 } from "commander";
 
 // src/auth/login.ts
-import { createServer } from "http";
 import open from "open";
 
+// src/auth/headless.ts
+function isHeadless(env = process.env, platform = process.platform) {
+  if (env.ODIN_FORCE_BROWSER === "1") return false;
+  if (env.SSH_CONNECTION || env.SSH_TTY) return true;
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return true;
+  if (env.CI) return true;
+  return false;
+}
+
+// src/auth/login-loopback.ts
+import { createServer } from "http";
+
 // src/auth/credentials.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync } from "fs";
 import { join } from "path";
@@ -34,69 +45,228 @@ function clearCredentials() {
   }
 }
 
-// src/auth/login.ts
+// src/auth/pkce.ts
+import { randomBytes, createHash } from "crypto";
+function generateVerifier() {
+  return randomBytes(64).toString("base64url");
+}
+function challengeFromVerifier(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+function generateState() {
+  return randomBytes(32).toString("hex");
+}
+
+// src/auth/login-loopback.ts
 var API_URL = process.env.ODIN_API_URL ?? "https://www.odin.mu";
-async function login() {
-  return new Promise((resolve3, reject) => {
-    const server = createServer(async (req, res) => {
-      if (req.method === "POST" && req.url?.startsWith("/callback")) {
-        let body = "";
-        for await (const chunk of req) {
-          body += chunk;
-        }
-        const params = new URLSearchParams(body);
-        const access_token = params.get("access_token");
-        const refresh_token = params.get("refresh_token");
-        const expires_at = params.get("expires_at");
-        if (!access_token || !refresh_token || !expires_at) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end("<html><body><p>Missing tokens. Login failed.</p></body></html>");
-          server.close();
-          reject(new Error("Missing tokens in callback"));
-          return;
-        }
-        const creds = {
-          access_token,
-          refresh_token,
-          expires_at: parseInt(expires_at, 10)
-        };
-        saveCredentials(creds);
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(`<!DOCTYPE html>
+var CLIENT_ID = "odin-cli";
+var TIMEOUT_MS = 18e4;
+var SUCCESS_HTML = `<!DOCTYPE html>
 <html><body style="margin:0;background:#111;color:#e5e5e5;font-family:monospace;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center">
   <div>
     <p style="color:#f2c94c;font-size:1.5rem;margin-bottom:0.5rem">&#10003; Login successful</p>
     <p style="color:#666;font-size:0.9rem">You can close this tab.</p>
   </div>
-</body></html>`);
-        server.close();
-        resolve3();
-      } else {
+</body></html>`;
+function buildAuthorizeUrl(params) {
+  const q = new URLSearchParams({
+    response_type: "code",
+    client_id: CLIENT_ID,
+    redirect_uri: params.redirectUri,
+    state: params.state,
+    code_challenge: params.challenge,
+    code_challenge_method: "S256"
+  });
+  return `${API_URL}/api/oauth/authorize?${q.toString()}`;
+}
+async function exchangeCode(args) {
+  const res = await fetch(`${API_URL}/api/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code: args.code,
+      code_verifier: args.verifier,
+      redirect_uri: args.redirectUri,
+      client_id: CLIENT_ID
+    }).toString()
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new Error(`Token exchange failed: ${json.error ?? res.status}`);
+  }
+  return {
+    access_token: json.access_token,
+    refresh_token: json.refresh_token,
+    expires_at: Math.floor(Date.now() / 1e3) + (json.expires_in ?? 3600)
+  };
+}
+function loginLoopback(onUrl) {
+  return new Promise((resolve3, reject) => {
+    const verifier = generateVerifier();
+    const challenge = challengeFromVerifier(verifier);
+    const state = generateState();
+    let redirectUri = "";
+    let settled = false;
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      server.close();
+      fn();
+    };
+    const server = createServer(async (req, res) => {
+      if (req.method !== "GET" || !req.url?.startsWith("/callback")) {
         res.writeHead(404);
         res.end();
+        return;
+      }
+      const url = new URL(req.url, redirectUri || "http://127.0.0.1");
+      const code = url.searchParams.get("code");
+      const returnedState = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      if (error) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(`<html><body><p>Login failed: ${error}</p></body></html>`);
+        finish(() => reject(new Error(`Authorization failed: ${error}`)));
+        return;
+      }
+      if (!code || returnedState !== state) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<html><body><p>Invalid callback. Login failed.</p></body></html>");
+        finish(
+          () => reject(new Error("Invalid callback: state mismatch or missing code"))
+        );
+        return;
+      }
+      try {
+        const creds = await exchangeCode({ code, verifier, redirectUri });
+        saveCredentials(creds);
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(SUCCESS_HTML);
+        finish(resolve3);
+      } catch (err) {
+        res.writeHead(500, { "Content-Type": "text/html" });
+        res.end("<html><body><p>Token exchange failed.</p></body></html>");
+        finish(() => reject(err));
       }
     });
-    server.listen(0, "127.0.0.1", () => {
+    server.listen(0, "127.0.0.1", async () => {
       const addr = server.address();
       if (!addr || typeof addr === "string") {
-        reject(new Error("Failed to start callback server"));
+        finish(() => reject(new Error("Failed to start callback server")));
         return;
       }
-      const port = addr.port;
-      const authUrl = `${API_URL}/auth/cli?port=${port}`;
-      console.error(`Opening browser for authentication...`);
+      redirectUri = `http://127.0.0.1:${addr.port}/callback`;
+      const authUrl = buildAuthorizeUrl({ redirectUri, state, challenge });
+      console.error("Opening browser for authentication...");
       console.error(`If the browser doesn't open, visit: ${authUrl}`);
-      open(authUrl).catch(() => {
-      });
+      try {
+        await onUrl(authUrl);
+      } catch (err) {
+        finish(() => reject(err));
+      }
     });
-    const timeout = setTimeout(() => {
-      server.close();
-      reject(new Error("Login timed out. Try again."));
-    }, 12e4);
+    const timeout = setTimeout(
+      () => finish(() => reject(new Error("Login timed out. Try 'odin login --device'."))),
+      TIMEOUT_MS
+    );
     server.on("close", () => clearTimeout(timeout));
   });
 }
 
+// src/auth/login-device.ts
+var API_URL2 = process.env.ODIN_API_URL ?? "https://www.odin.mu";
+var CLIENT_ID2 = "odin-cli";
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+async function requestDeviceCode() {
+  const res = await fetch(`${API_URL2}/api/oauth/device/code`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: CLIENT_ID2 }).toString()
+  });
+  if (!res.ok) {
+    throw new Error(`Could not start device login (HTTP ${res.status}).`);
+  }
+  return await res.json();
+}
+async function pollOnce(deviceCode) {
+  const res = await fetch(`${API_URL2}/api/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: DEVICE_GRANT,
+      device_code: deviceCode,
+      client_id: CLIENT_ID2
+    }).toString()
+  });
+  const json = await res.json().catch(() => ({}));
+  if (res.ok) {
+    return {
+      creds: {
+        access_token: json.access_token,
+        refresh_token: json.refresh_token,
+        expires_at: Math.floor(Date.now() / 1e3) + (json.expires_in ?? 3600)
+      }
+    };
+  }
+  return { error: json.error ?? `http_${res.status}` };
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function loginDevice(deps = {}) {
+  const nap = deps.sleepFn ?? sleep;
+  const start = await requestDeviceCode();
+  console.error("");
+  console.error(`  Open:  ${start.verification_uri}`);
+  console.error(`  Code:  ${start.user_code}`);
+  console.error("");
+  console.error("Waiting for approval...");
+  let interval = Math.max(1, start.interval || 5);
+  const deadline = Date.now() + start.expires_in * 1e3;
+  while (Date.now() < deadline) {
+    await nap(interval * 1e3);
+    const { creds, error } = await pollOnce(start.device_code);
+    if (creds) {
+      saveCredentials(creds);
+      return;
+    }
+    if (error === "authorization_pending") continue;
+    if (error === "slow_down") {
+      interval += 5;
+      continue;
+    }
+    if (error === "expired_token") {
+      throw new Error("The device code expired. Run 'odin login --device' again.");
+    }
+    if (error === "access_denied") {
+      throw new Error("Authorization was denied.");
+    }
+    throw new Error(`Device login failed: ${error}`);
+  }
+  throw new Error("The device code expired. Run 'odin login --device' again.");
+}
+
+// src/auth/login.ts
+async function login(options = {}) {
+  if (options.device || isHeadless()) {
+    return loginDevice();
+  }
+  try {
+    return await loginLoopback(async (url) => {
+      await open(url);
+    });
+  } catch (err) {
+    if (isOpenFailure(err)) {
+      console.error("Could not open a browser \u2014 falling back to device login.");
+      return loginDevice();
+    }
+    throw err;
+  }
+}
+function isOpenFailure(err) {
+  if (!(err instanceof Error)) return false;
+  return /spawn|ENOENT|xdg-open|Exited with code/i.test(err.message);
+}
+
 // src/commands/pebbles.ts
 import { Command } from "commander";
 
@@ -237,10 +407,10 @@ pebblesCmd.command("get <slug>").description("Get pebble details").action(async
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-pebblesCmd.command("create <slug>").description("Create a pebble").requiredOption("--name <name>", "Pebble name").option("--status <status>", "Initial status", "idea").option("--summary <summary>", "Summary").action(async (slug, opts) => {
+pebblesCmd.command("create <slug>").description("Create a pebble").requiredOption("--name <name>", "Pebble name").option("--status <status>", "Initial status", "idea").option("--summary <summary>", "Summary").option("--ticket-prefix <PREFIX>", "Four uppercase letters for ticket IDs (derived from slug when omitted)").action(async (slug, opts) => {
   const res = await apiRequest("/pebbles", {
     method: "POST",
-    body: { slug, name: opts.name, status: opts.status, summary: opts.summary }
+    body: { slug, name: opts.name, status: opts.status, summary: opts.summary, ticket_prefix: opts.ticketPrefix }
   });
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
@@ -1072,11 +1242,11 @@ betsCmd.command("get <slug> <id>").description("Get a bet by ID").action(async (
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-betsCmd.command("create <slug> <title>").description("Create a bet").option("--source <source>", "Source agent", "claude-code").option("--content <content>", "Bet content").option("--file <path>", "Read content from file").option("--status <status>", "Bet status (pitch, shaped, betting, active, blocked, building, done, archived)").option("--priority <priority>", "Bet priority").option("--appetite <appetite>", "Bet appetite").action(async (slug, title, opts) => {
+betsCmd.command("create <slug> <title>").description("Create a bet").option("--source <source>", "Source agent", "claude-code").option("--content <content>", "Bet content").option("--file <path>", "Read content from file").option("--status <status>", "Bet status (pitch, shaped, betting, active, blocked, building, done, archived)").option("--priority <priority>", "Bet priority").option("--appetite <appetite>", "Bet appetite").option("--follow-up-of <key-or-uuid>", "Allocate a suffixed follow-up ticket in this ticket's family (e.g. ODIN-12 \u2192 ODIN-12A)").action(async (slug, title, opts) => {
   const content = opts.file ? readFileSync10(opts.file, "utf-8") : opts.content ?? "";
   const res = await apiRequest(`/pebbles/${slug}/bets`, {
     method: "POST",
-    body: { title, source: opts.source, content, status: opts.status, priority: opts.priority, appetite: opts.appetite }
+    body: { title, source: opts.source, content, status: opts.status, priority: opts.priority, appetite: opts.appetite, follow_up_of: opts.followUpOf }
   });
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
@@ -1105,10 +1275,24 @@ betsCmd.command("delete <slug> <id>").description("Delete a bet").action(async (
 });
 betsCmd.addCommand(depsCmd);
 
-// src/commands/bet-comments.ts
+// src/commands/tickets.ts
 import { Command as Command15 } from "commander";
+var ticketsCmd = new Command15("tickets").description("Resolve human-readable ticket IDs");
+ticketsCmd.command("resolve <key>").description("Resolve a ticket key (e.g. ODIN-12, RATE-36A) to its bet or task, with historical candidates").action(async (key) => {
+  const res = await apiRequest(`/tickets/${encodeURIComponent(key.trim().toUpperCase())}`);
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.data?.legacy_ambiguous) {
+    const others = res.data.candidates.filter((c) => c.entity_id !== res.data.entity_id);
+    process.stderr.write(`note: ${key.toUpperCase()} was a duplicated legacy label; also matches ${others.map((c) => c.ticket_key ?? c.entity_id).join(", ")}
+`);
+  }
+  if (res.error) process.exit(1);
+});
+
+// src/commands/bet-comments.ts
+import { Command as Command16 } from "commander";
 import { readFileSync as readFileSync11 } from "fs";
-var betCommentsCmd = new Command15("bet-comments").description("Manage bet comments");
+var betCommentsCmd = new Command16("bet-comments").description("Manage bet comments");
 betCommentsCmd.command("list <slug> <betId>").description("List comments for a bet (oldest first)").action(async (slug, betId) => {
   const res = await apiRequest(`/pebbles/${slug}/bets/${betId}/comments`);
   process.stdout.write(JSON.stringify(res) + "\n");
@@ -1135,8 +1319,9 @@ betCommentsCmd.command("create <slug> <betId> [body]").description("Post a comme
 });
 
 // src/commands/tasks.ts
-import { Command as Command16 } from "commander";
-var tasksCmd = new Command16("tasks").description("Manage tasks");
+import { Command as Command17 } from "commander";
+import { readFileSync as readFileSync12 } from "fs";
+var tasksCmd = new Command17("tasks").description("Manage tasks");
 withListFlags(
   tasksCmd.command("list <slug>").description("List tasks for a pebble").option("--status <status>", "Filter by status").option("--bet <bet-id>", "Filter by bet ID")
 ).action(async (slug, opts) => {
@@ -1157,10 +1342,10 @@ tasksCmd.command("get <slug> <id>").description("Get a task by ID").action(async
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-tasksCmd.command("create <slug> <title>").description("Create a task").option("--source <source>", "Source agent", "claude-code").option("--description <description>", "Task description").option("--bet <bet-id>", "Parent bet ID").option("--status <status>", "Task status").option("--priority <priority>", "Task priority").action(async (slug, title, opts) => {
+tasksCmd.command("create <slug> <title>").description("Create a task").option("--source <source>", "Source agent", "claude-code").option("--description <description>", "Task description").option("--bet <bet-id>", "Parent bet ID").option("--status <status>", "Task status").option("--priority <priority>", "Task priority").option("--follow-up-of <key-or-uuid>", "Allocate a suffixed follow-up ticket in this ticket's family (e.g. ODIN-12 \u2192 ODIN-12A)").action(async (slug, title, opts) => {
   const res = await apiRequest(`/pebbles/${slug}/tasks`, {
     method: "POST",
-    body: { title, source: opts.source, description: opts.description, bet_id: opts.bet, status: opts.status, priority: opts.priority }
+    body: { title, source: opts.source, description: opts.description, bet_id: opts.bet, status: opts.status, priority: opts.priority, follow_up_of: opts.followUpOf }
   });
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
@@ -1179,6 +1364,15 @@ tasksCmd.command("update <slug> <id>").description("Update a task").option("--ti
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
+tasksCmd.command("promote <slug> <id>").description("Promote a task to a bet, keeping its ticket ID and history").option("--content <content>", "Shaped bet markdown").option("--file <path>", "Read bet markdown from file").option("--status <status>", "Bet status (pitch | shaped)", "shaped").option("--priority <priority>", "Bet priority").action(async (slug, id, opts) => {
+  const content = opts.file ? readFileSync12(opts.file, "utf-8") : opts.content;
+  const res = await apiRequest(`/pebbles/${slug}/tasks/${id}/promote`, {
+    method: "POST",
+    body: { content, status: opts.status, priority: opts.priority }
+  });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
 tasksCmd.command("delete <slug> <id>").description("Delete a task").action(async (slug, id) => {
   const res = await apiRequest(`/pebbles/${slug}/tasks/${id}`, {
     method: "DELETE"
@@ -1188,9 +1382,9 @@ tasksCmd.command("delete <slug> <id>").description("Delete a task").action(async
 });
 
 // src/commands/roadmaps.ts
-import { Command as Command17 } from "commander";
-import { readFileSync as readFileSync12 } from "fs";
-var roadmapsCmd = new Command17("roadmaps").description("Manage roadmaps");
+import { Command as Command18 } from "commander";
+import { readFileSync as readFileSync13 } from "fs";
+var roadmapsCmd = new Command18("roadmaps").description("Manage roadmaps");
 roadmapsCmd.command("list <slug>").description("List roadmaps for a pebble").option("--status <status>", "Filter by status").action(async (slug, opts) => {
   const params = {};
   if (opts.status) params.status = opts.status;
@@ -1204,7 +1398,7 @@ roadmapsCmd.command("get <slug> <id>").description("Get a roadmap by ID (include
   if (res.error) process.exit(1);
 });
 roadmapsCmd.command("create <slug> <title>").description("Create a roadmap").option("--source <source>", "Source agent", "claude-code").option("--content <content>", "Roadmap content").option("--file <path>", "Read content from file").option("--status <status>", "Roadmap status").action(async (slug, title, opts) => {
-  const content = opts.file ? readFileSync12(opts.file, "utf-8") : opts.content ?? "";
+  const content = opts.file ? readFileSync13(opts.file, "utf-8") : opts.content ?? "";
   const res = await apiRequest(`/pebbles/${slug}/roadmaps`, {
     method: "POST",
     body: { title, source: opts.source, content, status: opts.status }
@@ -1215,7 +1409,7 @@ roadmapsCmd.command("create <slug> <title>").description("Create a roadmap").opt
 roadmapsCmd.command("update <slug> <id>").description("Update a roadmap").option("--title <title>", "New title").option("--content <content>", "New content").option("--file <path>", "Read content from file").option("--status <status>", "New status").action(async (slug, id, opts) => {
   const body = {};
   if (opts.title) body.title = opts.title;
-  if (opts.file) body.content = readFileSync12(opts.file, "utf-8");
+  if (opts.file) body.content = readFileSync13(opts.file, "utf-8");
   else if (opts.content) body.content = opts.content;
   if (opts.status) body.status = opts.status;
   const res = await apiRequest(`/pebbles/${slug}/roadmaps/${id}`, {
@@ -1234,11 +1428,11 @@ roadmapsCmd.command("delete <slug> <id>").description("Delete a roadmap").action
 });
 
 // src/commands/persona-runs.ts
-import { Command as Command18 } from "commander";
-import { readFileSync as readFileSync13 } from "fs";
+import { Command as Command19 } from "commander";
+import { readFileSync as readFileSync14 } from "fs";
 import { join as join2 } from "path";
 import { homedir as homedir2 } from "os";
-var personaRunsCmd = new Command18("persona-runs").description(
+var personaRunsCmd = new Command19("persona-runs").description(
   "Manage per-persona per-session token usage rows"
 );
 personaRunsCmd.command("list <slug>").description("List persona runs for a pebble").option("--bet-id <id>", "Filter by bet_id").option("--plan-id <id>", "Filter by plan_id").option("--persona <name>", "Filter by persona name").option("--limit <n>", "Max rows", "50").action(async (slug, opts) => {
@@ -1262,7 +1456,7 @@ personaRunsCmd.command("get <slug> <id>").description("Get a persona run by id")
   if (res.error) process.exit(1);
 });
 personaRunsCmd.command("create <slug>").description("Create/upsert a persona run from a JSON file").requiredOption("--file <path>", "JSON payload matching PersonaRunCreate").action(async (slug, opts) => {
-  const body = JSON.parse(readFileSync13(opts.file, "utf-8"));
+  const body = JSON.parse(readFileSync14(opts.file, "utf-8"));
   const res = await apiRequest(`/pebbles/${slug}/persona-runs`, {
     method: "POST",
     body
@@ -1274,7 +1468,7 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
   const markerPath = opts.marker ?? join2(homedir2(), ".claude", "odin-context", `${opts.sessionId}.json`);
   let marker = {};
   try {
-    marker = JSON.parse(readFileSync13(markerPath, "utf-8"));
+    marker = JSON.parse(readFileSync14(markerPath, "utf-8"));
   } catch {
     process.exit(0);
   }
@@ -1284,7 +1478,7 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
   let input = 0, output = 0, cacheRead = 0, cacheCreate = 0;
   let minTs = null, maxTs = null;
   try {
-    const raw = readFileSync13(opts.transcript, "utf-8");
+    const raw = readFileSync14(opts.transcript, "utf-8");
     for (const line of raw.split("\n")) {
       if (!line.trim()) continue;
       let obj;
@@ -1335,9 +1529,9 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
 });
 
 // src/commands/blog.ts
-import { Command as Command19 } from "commander";
-import { readFileSync as readFileSync14 } from "fs";
-var blogCmd = new Command19("blog").description("Manage blog posts");
+import { Command as Command20 } from "commander";
+import { readFileSync as readFileSync15 } from "fs";
+var blogCmd = new Command20("blog").description("Manage blog posts");
 blogCmd.command("list <slug>").description("List blog posts for a pebble").option("--status <status>", "Filter by status (draft, review, scheduled, published, archived)").option("--tag <tag>", "Filter by tag").option("--page <page>", "Page number", "1").option("--per-page <perPage>", "Results per page", "20").action(async (slug, opts) => {
   const params = {};
   if (opts.status) params.status = opts.status;
@@ -1356,7 +1550,7 @@ blogCmd.command("get <slug> <idOrSlug>").description("Get a blog post by UUID or
 blogCmd.command("create <slug> <title>").description("Create a blog post").requiredOption("--post-slug <postSlug>", "URL slug for the post").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "Initial status (draft, review, scheduled)", "draft").option("--scheduled-publish-at <iso>", "UTC ISO timestamp for scheduled publishing (required when --status scheduled)").option("--metadata <metadata>", "Post metadata as JSON string").option("--campaign-id <campaignId>", "Link to a marketing campaign").action(async (slug, title, opts) => {
   let blocks = [];
   if (opts.file) {
-    blocks = JSON.parse(readFileSync14(opts.file, "utf-8"));
+    blocks = JSON.parse(readFileSync15(opts.file, "utf-8"));
   } else if (opts.blocks) {
     blocks = JSON.parse(opts.blocks);
   }
@@ -1380,7 +1574,7 @@ blogCmd.command("update <slug> <id>").description("Update a blog post").option("
   const body = {};
   if (opts.title) body.title = opts.title;
   if (opts.postSlug) body.slug = opts.postSlug;
-  if (opts.file) body.blocks = JSON.parse(readFileSync14(opts.file, "utf-8"));
+  if (opts.file) body.blocks = JSON.parse(readFileSync15(opts.file, "utf-8"));
   else if (opts.blocks) body.blocks = JSON.parse(opts.blocks);
   if (opts.status) body.status = opts.status;
   if (opts.scheduledPublishAt !== void 0)
@@ -1402,8 +1596,8 @@ blogCmd.command("delete <slug> <id>").description("Delete a blog post").action(a
 });
 
 // src/commands/api-keys.ts
-import { Command as Command20 } from "commander";
-var apiKeysCmd = new Command20("api-keys").description("Manage API keys for server-to-server access");
+import { Command as Command21 } from "commander";
+var apiKeysCmd = new Command21("api-keys").description("Manage API keys for server-to-server access");
 apiKeysCmd.command("list <slug>").description("List API keys for a pebble").action(async (slug) => {
   const res = await apiRequest(`/pebbles/${slug}/api-keys`);
   process.stdout.write(JSON.stringify(res) + "\n");
@@ -1445,7 +1639,7 @@ apiKeysCmd.command("delete <slug> <id>").description("Permanently delete an API
 });
 
 // src/commands/pebble/index.ts
-import { Command as Command21 } from "commander";
+import { Command as Command22 } from "commander";
 
 // src/commands/pebble/provisioner.ts
 async function runProvisioner(ctx, steps) {
@@ -1565,15 +1759,15 @@ var githubRepoStep = {
 };
 var githubSecretStep = {
   id: "github-secret",
-  label: "GitHub Actions secret DOPPLER_TOKEN_PRD",
+  label: "GitHub Actions secret DOPPLER_TOKEN",
   async check(ctx) {
     const cli = await run("gh", ["--version"]);
     if (!cli.ok) {
       return { status: "blocked", detail: "GitHub CLI not found. Install + run `gh auth login`." };
     }
     const list = await run("gh", ["secret", "list", "-R", `${ORG}/${ctx.slug}`]);
-    if (list.ok && /DOPPLER_TOKEN_PRD/.test(list.stdout)) {
-      return { status: "satisfied", detail: "DOPPLER_TOKEN_PRD already set" };
+    if (list.ok && /\bDOPPLER_TOKEN\b/.test(list.stdout)) {
+      return { status: "satisfied", detail: "DOPPLER_TOKEN already set" };
     }
     return null;
   },
@@ -1581,7 +1775,7 @@ var githubSecretStep = {
     if (ctx.dryRun) {
       return {
         status: "applied",
-        detail: "[dry-run] would mint scoped prd token and set DOPPLER_TOKEN_PRD"
+        detail: "[dry-run] would mint scoped prd token and set DOPPLER_TOKEN"
       };
     }
     const token = await run("doppler", [
@@ -1599,13 +1793,13 @@ var githubSecretStep = {
       return { status: "failed", detail: `doppler token mint failed: ${token.stderr}` };
     }
     const set = await setSecretViaStdin(
-      ["secret", "set", "DOPPLER_TOKEN_PRD", "-R", `${ORG}/${ctx.slug}`],
+      ["secret", "set", "DOPPLER_TOKEN", "-R", `${ORG}/${ctx.slug}`],
       token.stdout.trim()
     );
     if (!set.ok) {
       return { status: "failed", detail: `gh secret set failed: ${set.stderr}` };
     }
-    return { status: "applied", detail: "Set DOPPLER_TOKEN_PRD (read-only prd token)" };
+    return { status: "applied", detail: "Set DOPPLER_TOKEN (read-only prd token)" };
   }
 };
 function setSecretViaStdin(args, value) {
@@ -1648,7 +1842,7 @@ var vercelStep = {
 };
 
 // src/commands/pebble/steps/r2.ts
-var bucketName = (slug) => `${slug}-tfstate`;
+var bucketName = (slug) => `${slug}-web-tfstate`;
 var r2Step = {
   id: "r2",
   label: "Cloudflare R2 tfstate bucket",
@@ -1858,7 +2052,7 @@ Hand off: /odin:eng-manager bet:${bet.data.id}
 }
 
 // src/commands/pebble/index.ts
-var pebbleCmd = new Command21("pebble").description(
+var pebbleCmd = new Command22("pebble").description(
   "Provision and initialize pebbles (eng-infra, run-once)"
 );
 pebbleCmd.command("new <name>").description("Provision a new pebble from pebble-template (day-one)").option("--run", "Hand off to eng-manager on the init bet").option("--dir <path>", "Parent dir to clone into").option("--dry-run", "Print the plan; mutate nothing").action(async (name, opts) => {
@@ -1879,7 +2073,7 @@ pebbleCmd.command("provision <provider> <slug>").description("Run one provider s
 });
 
 // src/commands/create/index.ts
-import { Command as Command22 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/commands/create/topology.ts
 var ENVS = ["prd", "stg", "dev"];
@@ -2010,8 +2204,8 @@ var githubProdEnvStep = {
 };
 
 // src/commands/create/steps/supabase.ts
-import { randomBytes } from "crypto";
-var genPassword = () => randomBytes(18).toString("base64url");
+import { randomBytes as randomBytes2 } from "crypto";
+var genPassword = () => randomBytes2(18).toString("base64url");
 function supabaseStep2(env) {
   return {
     id: `supabase-${env}`,
@@ -2344,22 +2538,22 @@ function assembleInputs(ctx) {
 }
 
 // src/commands/create/index.ts
-var createCmd = new Command22("create").description(
+var createCmd = new Command23("create").description(
   "Create and provision a new project end to end"
 );
 createCmd.command("project [name]").description("Guided self-serve project + parallel-env provisioning").option("--dry-run", "Print the plan; mutate nothing").action(
   async (name, opts) => process.exit(await runCreate(name, { dryRun: opts.dryRun }))
 );
-var setupCmd = new Command22("setup").description("Alias for `create project`").arguments("[name]").option("--dry-run", "Print the plan; mutate nothing").action(
+var setupCmd = new Command23("setup").description("Alias for `create project`").arguments("[name]").option("--dry-run", "Print the plan; mutate nothing").action(
   async (name, opts) => process.exit(await runCreate(name, { dryRun: opts.dryRun }))
 );
 
 // src/index.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 import { fileURLToPath } from "url";
 import { dirname as dirname2, resolve as resolve2 } from "path";
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync15(resolve2(__dirname, "../package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync16(resolve2(__dirname, "../package.json"), "utf-8"));
 var GOLD = "\x1B[33m";
 var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
@@ -2377,12 +2571,12 @@ ${RESET}
   ${DIM}${cwd}${RESET}
 `);
 }
-var program = new Command23();
+var program = new Command24();
 program.name("odin").description("CLI for Odin \u2014 the knowledge backbone for Pebble House").version(VERSION);
-program.command("login").description("Authenticate with Odin via browser").action(async () => {
+program.command("login").description("Authenticate with Odin via browser").option("--device", "Use the device-code flow (for headless or remote machines)").action(async (options) => {
   printBanner();
   try {
-    await login();
+    await login({ device: options.device });
     console.error(`${GOLD}Logged in successfully.${RESET}`);
   } catch (err) {
     console.error(`Login failed: ${err instanceof Error ? err.message : err}`);
@@ -2406,6 +2600,7 @@ program.addCommand(rulesCmd);
 program.addCommand(briefsCmd);
 program.addCommand(blueprintsCmd);
 program.addCommand(betsCmd);
+program.addCommand(ticketsCmd);
 program.addCommand(betCommentsCmd);
 program.addCommand(tasksCmd);
 program.addCommand(roadmapsCmd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pebblehouse/odin-cli",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "type": "module",
   "description": "CLI for Odin — the knowledge backbone for Pebble House",
   "bin": {