@allocator-one/harness-cli 1.0.0

package/dist/cli.js

@@ -0,0 +1,718 @@
+#!/usr/bin/env node
+import {
+  Client,
+  CommandError,
+  DEFAULT_BASE_URL,
+  HttpError,
+  LocalError,
+  TransportError,
+  UpgradeRequiredError,
+  UsageError,
+  archive,
+  attachImage,
+  blocked,
+  clean,
+  close,
+  comment,
+  comments,
+  create,
+  defaultCredentialsPath,
+  deleteCredentials,
+  dep,
+  docCreate,
+  docList,
+  docShow,
+  docUpdate,
+  json,
+  labelCreate,
+  labelList,
+  linkAdd,
+  linkList,
+  linkRm,
+  list,
+  loginHelp,
+  milestoneCreate,
+  milestoneList,
+  prime,
+  projectCreate,
+  projectList,
+  projectShow,
+  projectUpdate,
+  readCredentials,
+  ready,
+  requireIdentifiers,
+  resolveConfig,
+  search,
+  show,
+  stats,
+  teamList,
+  update,
+  upload,
+  userList,
+  validateBaseUrl,
+  version,
+  workflowStates,
+  writeCredentials
+} from "./chunk-KN5ILZSA.js";
+
+// src/cli.ts
+import { Command, CommanderError, InvalidArgumentError } from "commander";
+
+// src/core/auth.ts
+import { createHash, randomBytes } from "crypto";
+import { execFile } from "child_process";
+import { accessSync, constants as fsConstants } from "fs";
+import { createServer } from "http";
+import { delimiter, join } from "path";
+import { createInterface } from "readline";
+
+// src/core/login-page.ts
+var LOGO = '<svg width="210" height="34" viewBox="0 0 210 34" fill="none" role="img" aria-label="Infra One" xmlns="http://www.w3.org/2000/svg">\n  <style>\n    path {\n      fill: #353535\n    }\n\n    @media (prefers-color-scheme: dark) {\n      path {\n        fill: white\n      }\n    }\n  </style>\n  <g id="I1_logo_full">\n    <g id="Infra One Logo">\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M44.2202 29.5139V4.04761H49.617V29.5139H44.2202Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M121.159 11.873V13.998C119.877 12.4464 117.853 11.4345 115.29 11.4345C110.23 11.4345 106.284 15.3809 106.284 20.7103C106.284 26.0397 110.23 29.9861 115.29 29.9861C118.157 29.9861 119.877 28.9742 121.159 27.3214V29.4464H125.948V11.9067H121.159V11.873ZM116.099 25.8373C113.063 25.8373 110.938 23.7123 110.938 20.6091C110.938 17.5059 113.063 15.4484 116.099 15.4484C119.135 15.4484 121.327 17.5734 121.327 20.6091C121.327 23.6448 119.034 25.8373 116.099 25.8373Z" />\n      <path d="M15.6508 0H27.8611V34H15.6508V0ZM0 11.131C0 7.92659 2.66468 5.2619 5.86905 5.2619H6.34127C9.54564 5.2619 12.2103 7.92659 12.2103 11.131C12.2103 14.3353 9.54564 17 6.34127 17H5.86905C2.66468 17 0 14.3353 0 11.131Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M88.4405 10.4901C87.6984 10.2203 87.3611 10.0179 86.3155 10.0179C84.8651 10.0179 84.123 10.7599 84.123 12.2103V13.627H89.4524V17.6746H84.123V29.4802H79.3333V17.6746H76.2976V13.627H79.3333V12.2103C79.3333 8.36511 81.1548 5.86908 85.4048 5.86908C87.631 5.86908 88.1706 6.13892 89.621 6.71233L88.4405 10.4901Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M98.0199 14.4365C99.133 12.4127 101.224 11.2321 104.091 11.6032V15.9206C100.246 15.381 98.0199 17.0337 98.0199 21.7897V29.4127H93.2302V11.873H98.0199V14.4365Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M65.5715 11.4008C70.3611 11.4008 72.756 14.5377 72.756 19.2262V29.5139H67.9663V20.0357C67.9663 17.371 66.6845 15.6171 64.1211 15.6171C61.5576 15.6171 59.7024 17.6409 59.7024 20.7778V29.5139H54.9127V11.873H59.7024V14.0655C60.9842 12.5139 62.9068 11.4008 65.5715 11.4008Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M151.01 4.621C143.387 4.621 137.687 10.0516 137.687 17.3035C137.687 24.5555 143.286 29.9861 151.01 29.9861C158.734 29.9861 164.232 24.4881 164.232 17.3035C164.232 10.119 158.633 4.621 151.01 4.621ZM151.01 25.5674C145.95 25.5674 142.746 21.992 142.746 17.3035C142.746 12.6151 145.95 9.10712 151.01 9.10712C156.069 9.10712 159.274 12.7837 159.274 17.3035C159.274 21.8234 155.968 25.5674 151.01 25.5674Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M179.309 11.4008C184.099 11.4008 186.494 14.5377 186.494 19.2262V29.5139H181.704V20.0357C181.704 17.371 180.423 15.6171 177.859 15.6171C175.296 15.6171 173.44 17.6409 173.44 20.7778V29.5139H168.651V11.873H173.44V14.0655C174.722 12.5139 176.645 11.4008 179.309 11.4008Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M209.565 20.2381C209.565 15.1786 206.26 11.3333 200.188 11.3333C194.117 11.3333 190.643 15.3809 190.643 20.6091C190.643 25.8373 194.69 29.8849 200.559 29.8849C206.429 29.8849 208.284 27.119 209.397 24.8254L205.079 23.6448C204.337 24.9266 202.954 25.9385 200.661 25.9385C197.355 25.9385 195.702 24.1845 195.331 21.8909H209.498C209.599 21.3512 209.599 20.7778 209.599 20.2381H209.565ZM195.298 19.125C195.567 17.1012 197.321 15.2797 200.155 15.2797C202.988 15.2797 204.742 17.0337 204.944 19.125H195.298Z" />\n    </g>\n  </g>\n</svg>';
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function loginPage(message) {
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<!-- The logo paints itself white under a dark preference; without this the
+     canvas stays white and the logo disappears. -->
+<meta name="color-scheme" content="light dark">
+<title>harness login</title></head>
+<body style="margin: 0;">
+<main style="min-height: 100vh; padding: 1.5rem; display: flex; flex-direction: column; align-items: center; justify-content: center; gap: 2rem; text-align: center; font-family: system-ui, sans-serif;">
+${LOGO}
+<p style="margin: 0;">${escapeHtml(message)}</p>
+</main>
+</body></html>
+`;
+}
+
+// src/core/auth.ts
+var DEFAULT_TIMEOUT_MS = 18e4;
+function generateState() {
+  return randomBytes(24).toString("base64url");
+}
+function generateVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+function challengeFor(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+async function login(baseUrl, options = {}) {
+  const validated = validateBaseUrl(baseUrl);
+  if (!validated.ok) return { ok: false, message: validated.message };
+  const base = baseUrl.replace(/\/+$/, "");
+  if (options.noBrowser === true || !browserAvailable(options)) {
+    return manualLogin(base, options);
+  }
+  return loopbackLogin(base, options);
+}
+function browserAvailable(options) {
+  if ("openBrowser" in options) return typeof options.openBrowser === "function";
+  return browserOpener() !== null && displayAvailable(options.env ?? process.env);
+}
+function findExecutable(name, pathVar = process.env["PATH"]) {
+  for (const dir of (pathVar ?? "").split(delimiter)) {
+    if (dir === "") continue;
+    const candidate = join(dir, name);
+    try {
+      accessSync(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function browserOpener() {
+  const name = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
+  if (name === null) return null;
+  return findExecutable(name);
+}
+function displayAvailable(env) {
+  const display = env["DISPLAY"];
+  const remote = isSet(env["SSH_CONNECTION"]) || isSet(env["SSH_TTY"]);
+  const hasDisplay = isSet(display) || isSet(env["WAYLAND_DISPLAY"]);
+  const forwarded = typeof display === "string" && display.startsWith("localhost:");
+  if (process.platform === "darwin") return !remote;
+  if (process.platform === "linux") return hasDisplay && (!remote || forwarded);
+  return !remote;
+}
+function isSet(value) {
+  return value !== void 0 && value !== "";
+}
+async function loopbackLogin(baseUrl, options) {
+  const notify = options.notify ?? defaultNotify;
+  const state = generateState();
+  const verifier = generateVerifier();
+  const challenge = challengeFor(verifier);
+  const server = createServer();
+  const port = await new Promise((resolve) => {
+    server.once("error", () => resolve(null));
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      resolve(typeof address === "object" && address !== null ? address.port : null);
+    });
+  });
+  if (port === null) {
+    return { ok: false, message: "could not open a loopback port for the browser handoff" };
+  }
+  try {
+    const query = new URLSearchParams({ port: String(port), state, challenge });
+    const url = `${baseUrl}/cli/login?${query.toString()}`;
+    const openBrowser = options.openBrowser ?? defaultOpenBrowser;
+    openBrowser(url);
+    notify(`Opening ${url}`);
+    notify("Waiting for the browser authorization (Ctrl-C to abort)\u2026");
+    const code = await awaitCallback(server, state, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    if (!code.ok) return code;
+    const token = await exchangeCode(baseUrl, code.code, verifier, options);
+    if (!token.ok) return token;
+    return await verifyAndStore(baseUrl, token.token, options);
+  } finally {
+    server.closeAllConnections();
+    server.close();
+  }
+}
+function awaitCallback(server, state, timeoutMs) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      resolve({ ok: false, message: "timed out waiting for the browser authorization" });
+    }, timeoutMs);
+    server.on("request", (request, response) => {
+      const respond = (status, message) => {
+        response.writeHead(status, { "content-type": "text/html; charset=utf-8" });
+        response.end(loginPage(message));
+      };
+      let url;
+      try {
+        url = new URL(request.url ?? "/", "http://127.0.0.1");
+      } catch {
+        respond(404, "Waiting for the harness login callback.");
+        return;
+      }
+      if (url.pathname !== "/callback") {
+        respond(404, "Waiting for the harness login callback.");
+        return;
+      }
+      const code = url.searchParams.get("code");
+      if (url.searchParams.get("state") === state && code !== null && code !== "") {
+        respond(200, "Signed in \u2014 you can close this tab and return to the terminal.");
+        clearTimeout(timer);
+        resolve({ ok: true, code });
+      } else {
+        respond(400, "This is not the callback this login is waiting for \u2014 run harness login again if needed.");
+      }
+    });
+  });
+}
+async function exchangeCode(baseUrl, code, verifier, options) {
+  try {
+    const body = await bareClient(baseUrl, "", options).post(
+      "/api/v1/cli/token-exchange",
+      { code, code_verifier: verifier }
+    );
+    const token = body.data?.token;
+    if (typeof token === "string" && token !== "") return { ok: true, token };
+    return { ok: false, message: "the login-code exchange returned no token \u2014 aborting" };
+  } catch (error) {
+    if (error instanceof HttpError) {
+      return { ok: false, message: `the login-code exchange failed: ${error.message}` };
+    }
+    if (error instanceof TransportError) {
+      return { ok: false, message: `the login-code exchange failed: cannot reach the API (${error.message})` };
+    }
+    throw error;
+  }
+}
+async function manualLogin(baseUrl, options) {
+  const notify = options.notify ?? defaultNotify;
+  const prompt = options.prompt ?? defaultPrompt;
+  notify(`Open ${baseUrl}/cli/login in a browser, authorize, and paste the token below.`);
+  const token = (await prompt()).trim();
+  if (token === "") return { ok: false, message: "no token entered" };
+  return verifyAndStore(baseUrl, token, options);
+}
+async function verifyAndStore(baseUrl, token, options) {
+  const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
+  const client = bareClient(baseUrl, token, options);
+  try {
+    await client.get("/api/v1/teams");
+  } catch (error) {
+    if (error instanceof HttpError) {
+      return {
+        ok: false,
+        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored`
+      };
+    }
+    if (error instanceof TransportError) {
+      return {
+        ok: false,
+        message: `could not verify the token: cannot reach the API (${error.message}) \u2014 nothing was stored`
+      };
+    }
+    throw error;
+  }
+  const stored = readCredentials(path);
+  const superseded = stored !== null && stored.token !== token ? stored : null;
+  try {
+    writeCredentials(path, baseUrl, token);
+  } catch (error) {
+    await client.delete("/api/v1/session").catch(() => void 0);
+    const detail = error instanceof Error ? error.message : String(error);
+    return { ok: false, message: `could not store credentials at ${path}: ${detail}` };
+  }
+  if (superseded !== null) {
+    await bareClient(superseded.url, superseded.token, options).delete("/api/v1/session").catch(() => void 0);
+  }
+  return {
+    ok: true,
+    json: { url: baseUrl, credentials: path },
+    human: `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; harness logout revokes it).
+`
+  };
+}
+async function logout(options = {}) {
+  const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
+  const stored = readCredentials(path);
+  if (stored === null) {
+    return {
+      ok: false,
+      message: "No stored login to remove. A HARNESS_API_TOKEN from the environment is yours to manage \u2014 unset it, or disable the token in the admin UI."
+    };
+  }
+  const revoked = await bareClient(stored.url, stored.token, options).delete("/api/v1/session").then(() => true).catch(() => false);
+  const note = revoked ? "" : " (server-side revoke failed \u2014 the token still expires on its own)";
+  try {
+    deleteCredentials(path);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      message: `could not remove ${path} (${detail}) \u2014 delete it manually.` + (revoked ? " The token itself was revoked." : "")
+    };
+  }
+  return {
+    ok: true,
+    json: { logged_out: true, revoked },
+    human: `Logged out of ${stored.url}${note}.
+`
+  };
+}
+async function whoami(config, credentialSource) {
+  const client = new Client(config);
+  try {
+    await client.get("/api/v1/stats");
+  } catch (error) {
+    if (error instanceof HttpError) {
+      return {
+        ok: false,
+        message: `signed in to ${config.baseUrl} with a ${credentialSource} credential, but it failed verification: ${error.message} (HTTP ${error.status})`
+      };
+    }
+    throw error;
+  }
+  const serverVersion = await client.serverVersion().catch(() => "unknown");
+  return {
+    ok: true,
+    json: { url: config.baseUrl, source: credentialSource, verified: true, server_version: serverVersion },
+    human: `Host:        ${config.baseUrl}
+Credential:  ${credentialSource}
+Verified:    ok (server API ${serverVersion})
+`
+  };
+}
+function bareClient(baseUrl, token, options) {
+  const config = {
+    baseUrl: baseUrl.replace(/\/+$/, ""),
+    token,
+    actor: null,
+    team: null,
+    cacheDir: ""
+  };
+  if (options.fetchImpl !== void 0) config.fetchImpl = options.fetchImpl;
+  return new Client(config);
+}
+function defaultNotify(line) {
+  process.stderr.write(line + "\n");
+}
+function defaultPrompt() {
+  const readline = createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((resolve) => {
+    readline.question("Token: ", (answer) => {
+      readline.close();
+      resolve(answer);
+    });
+  });
+}
+function defaultOpenBrowser(url) {
+  const opener = browserOpener();
+  if (opener !== null) {
+    execFile(opener, [url], () => void 0);
+  }
+}
+
+// src/cli.ts
+function exitWith(code) {
+  const drain = (stream) => new Promise((resolve) => stream.write("", () => resolve()));
+  return Promise.all([drain(process.stdout), drain(process.stderr)]).then(() => process.exit(code));
+}
+var program = new Command();
+program.name("harness").description("issue tracking for humans and agents (harness.infra.one)").exitOverride().configureOutput({
+  writeOut: (text) => process.stdout.write(text),
+  writeErr: (text) => process.stderr.write(text)
+});
+function integer(value) {
+  if (!/^\d+$/.test(value)) throw new InvalidArgumentError("expected a non-negative integer");
+  return Number.parseInt(value, 10);
+}
+function collect(value, previous) {
+  return [...previous, value];
+}
+var requireIdentifiers2 = requireIdentifiers;
+function interactive() {
+  const ci = process.env["CI"];
+  return process.stdout.isTTY === true && (ci === void 0 || ci === "");
+}
+async function withConfig(jsonFlag, mutating, run) {
+  const resolved = resolveConfig();
+  if (resolved.kind === "error") {
+    process.stderr.write(`harness: ${resolved.message}
+`);
+    return exitWith(2);
+  }
+  if (resolved.kind === "needs-login") {
+    if (!interactive()) {
+      process.stderr.write(loginHelp(resolved.baseUrl));
+      return exitWith(2);
+    }
+    const loginResult = await login(resolved.baseUrl, {});
+    if (!loginResult.ok) {
+      process.stderr.write(`harness: ${clean(loginResult.message)}
+`);
+      return exitWith(1);
+    }
+    process.stderr.write(loginResult.human);
+    const again = resolveConfig();
+    if (again.kind !== "ok") {
+      process.stderr.write(`harness: still not signed in to ${resolved.baseUrl} after logging in
+`);
+      return exitWith(1);
+    }
+    return execute(again.config, jsonFlag, mutating, run);
+  }
+  return execute(resolved.config, jsonFlag, mutating, run);
+}
+async function execute(config, jsonFlag, mutating, run) {
+  const client = new Client(config);
+  const hostNotice = mutating ? `\u2192 ${config.baseUrl}
+` : "";
+  try {
+    const output = await run({ client, config });
+    process.stderr.write(hostNotice);
+    if (output.notice !== void 0) process.stderr.write(output.notice);
+    process.stdout.write(jsonFlag ? json(output.json) : output.human);
+    return exitWith(output.partial === true ? 1 : 0);
+  } catch (error) {
+    return fail(error, hostNotice);
+  }
+}
+async function fail(error, hostNotice) {
+  if (error instanceof UsageError) {
+    process.stderr.write(error.message + "\n");
+    return exitWith(2);
+  }
+  if (error instanceof LocalError) {
+    process.stderr.write(`harness: ${clean(error.message)}
+`);
+    return exitWith(1);
+  }
+  if (error instanceof TransportError) {
+    process.stderr.write(hostNotice + `harness: cannot reach the API: ${clean(error.message)}
+`);
+    return exitWith(3);
+  }
+  if (error instanceof UpgradeRequiredError) {
+    process.stderr.write(hostNotice + `harness: ${clean(error.message)} (HTTP 426)
+`);
+    return exitWith(1);
+  }
+  if (error instanceof HttpError) {
+    process.stderr.write(
+      hostNotice + `harness: ${clean(error.message)} (HTTP ${error.status})${errorDetails(error.body)}
+`
+    );
+    return exitWith(1);
+  }
+  if (error instanceof CommandError) {
+    process.stderr.write(hostNotice + `harness: ${clean(error.message)}
+`);
+    return exitWith(1);
+  }
+  throw error;
+}
+function errorDetails(body) {
+  const details = body["details"];
+  if (typeof details !== "object" || details === null || Array.isArray(details)) return "";
+  return Object.entries(details).map(([field, messages]) => {
+    const text = Array.isArray(messages) ? messages.map(String).join("; ") : String(messages);
+    return `
+  ${clean(field)}: ${clean(text)}`;
+  }).join("");
+}
+program.command("ready").description("issues ready to work, highest priority first").option("--claim", "atomically claim the first claimable issue").option("--team <key>", "team filter").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, opts.claim === true, (ctx) => ready(ctx, opts));
+});
+program.command("blocked").description("issues waiting on a blocker").option("--team <key>", "team filter").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => blocked(ctx, opts));
+});
+program.command("list").description("list issues with filters").option("--status <status>", "open | in_progress | closed").option("--assignee <who>", 'me, a user id, an email, or a full name; "" for unassigned').option("--priority <name>", "urgent | high | medium | low | none").option("--label <name>", "label filter").option("--type <type>", "task | bug | feature | epic").option("--search <query>", "full-text search").option("--team <key>", "team filter").option("--parent <id>", "children of an epic").option("--scope <scope>", "all | archived").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => list(ctx, opts));
+});
+program.command("search").description("full-text search").argument("[query...]").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (query, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => search(ctx, query, opts));
+});
+program.command("show").description("full issue detail; downloads attached images locally").argument("[id]").option("--no-images", "skip attachment downloads").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (id === void 0) throw new UsageError("usage: harness show <id>");
+    requireIdentifiers2([id]);
+    return show(ctx, id, opts);
+  });
+});
+program.command("stats").description("per-team and total counts").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => stats(ctx));
+});
+program.command("prime").description("workflow context for agent sessions: stats + ready queue").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => prime(ctx));
+});
+program.command("version").description("print CLI and server API versions").option("--json", "emit JSON").action(async (opts) => {
+  const resolved = resolveConfig();
+  let config = null;
+  if (resolved.kind === "ok") config = resolved.config;
+  else if (resolved.kind === "needs-login") {
+    config = { baseUrl: resolved.baseUrl, token: "", actor: null, team: null, cacheDir: "" };
+  }
+  const output = await version(config);
+  process.stdout.write(opts.json === true ? json(output.json) : output.human);
+  await exitWith(0);
+});
+program.command("create").description("create an issue").option("--title <text>", "issue title (required)").option("--description <text>", "problem statement").option("--design <text>", "design notes").option("--notes <text>", "working notes").option("--acceptance <text>", "acceptance criteria").option("--type <type>", "task | bug | feature | epic (applied as a type/ label)").option("--priority <name>", "urgent | high | medium | low | none").option("--due-date <date>", "YYYY-MM-DD").option("--parent <id>", "parent epic").option("--assignee <who>", "me, a user id, an email, or a full name").option("--team <key>", "team key (or HARNESS_TEAM)").option("--label <name>", "label to apply (repeatable)", collect, []).option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, true, (ctx) => create(ctx, opts));
+});
+program.command("update").description("update an issue; --claim takes it atomically").argument("[id]").option("--claim", "claim atomically and move to the first started state").option("--state <name>", "workflow state by name or type").option("--title <text>").option("--description <text>").option("--design <text>").option("--notes <text>", "replace the notes").option("--append-notes <text>", "append to the notes").option("--acceptance <text>").option("--priority <name>", "urgent | high | medium | low | none").option("--due-date <date>", 'YYYY-MM-DD; "" clears').option("--parent <id>").option("--assignee <who>", 'me, a user id, an email, or a full name; "" unassigns').option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (id === void 0) {
+      throw new UsageError("usage: harness update <id> --claim | --title \u2026 | --state <name> | \u2026");
+    }
+    requireIdentifiers2([id]);
+    return update(ctx, id, opts);
+  });
+});
+program.command("close").description("close issues; the response lists newly unblocked issues").argument("[ids...]").option("--reason <text>", "why it is done (e.g. the commit hash)").option("--cancel", "close as canceled instead of completed").option("--json", "emit JSON").action(async (ids, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (ids.length === 0) {
+      throw new UsageError("usage: harness close <id> [<id>\u2026] [--reason <text>] [--cancel]");
+    }
+    requireIdentifiers2(ids);
+    return close(ctx, ids, opts);
+  });
+});
+program.command("archive").description("archive issues; --restore brings them back").argument("[ids...]").option("--restore", "restore instead of archive").option("--json", "emit JSON").action(async (ids, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (ids.length === 0) throw new UsageError("usage: harness archive <id> [<id>\u2026] [--restore]");
+    requireIdentifiers2(ids);
+    return archive(ctx, ids, opts);
+  });
+});
+program.command("comments").description("an issue's full comment thread, untruncated").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (id === void 0) throw new UsageError("usage: harness comments <id>");
+    requireIdentifiers2([id]);
+    return comments(ctx, id);
+  });
+});
+program.command("dep").description("blocking dependencies: dep add|rm <issue> <blocker>").argument("[verb]").argument("[issue]").argument("[blocker]").option("--json", "emit JSON").action(async (verb, issue, blocker, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (verb === void 0 || issue === void 0 || blocker === void 0) {
+      throw new UsageError("usage: harness dep add|rm <issue> <blocker>");
+    }
+    requireIdentifiers2([issue, blocker]);
+    return dep(ctx, verb, issue, blocker);
+  });
+});
+program.command("comment").description("comment on an issue").argument("[id]").argument("[text...]").option("--mention <name>", "notify a person (repeatable)", collect, []).option("--json", "emit JSON").action(async (id, text, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (id === void 0 || text.length === 0) {
+      throw new UsageError("usage: harness comment <id> <text> [--mention NAME]\u2026");
+    }
+    requireIdentifiers2([id]);
+    const mentions = opts.mention.filter((name) => name.trim() !== "");
+    return comment(ctx, id, text, mentions);
+  });
+});
+program.command("attach-image").description("upload an image; prints markdown to reference it").argument("[path]").option("--json", "emit JSON").action(async (path, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (path === void 0) {
+      throw new UsageError("usage: harness attach-image <path>  (one png, jpg, webp or gif, up to 25 MB)");
+    }
+    return attachImage(ctx, path);
+  });
+});
+var project = program.command("project").description("projects");
+project.command("list").option("--search <query>", "full-text search").option("--state <state>", "project state filter").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => projectList(ctx, opts));
+});
+project.command("show").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (id === void 0) throw new UsageError("usage: harness project show <id>");
+    return projectShow(ctx, id);
+  });
+});
+project.command("create").option("--name <name>", "project name (required)").option("--description <text>").option("--summary <text>").option("--state <state>").option("--lead <user-id>", "lead by user id").option("--start-date <date>", "YYYY-MM-DD").option("--target-date <date>", "YYYY-MM-DD").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, true, (ctx) => projectCreate(ctx, opts));
+});
+project.command("update").argument("[id]").option("--name <name>").option("--description <text>").option("--summary <text>").option("--state <state>").option("--lead <user-id>", "lead by user id").option("--start-date <date>", 'YYYY-MM-DD; "" clears').option("--target-date <date>", 'YYYY-MM-DD; "" clears').option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (id === void 0) throw new UsageError("usage: harness project update <id> --name \u2026 | --state \u2026 | \u2026");
+    return projectUpdate(ctx, id, opts);
+  });
+});
+var milestone = program.command("milestone").description("project milestones");
+milestone.command("list").option("--project <id>", "project id (required)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => milestoneList(ctx, opts.project));
+});
+milestone.command("create").option("--project <id>", "project id (required)").option("--name <name>", "milestone name (required)").option("--description <text>").option("--target-date <date>", "YYYY-MM-DD").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, true, (ctx) => milestoneCreate(ctx, opts));
+});
+var doc = program.command("doc").description("documents");
+doc.command("list").option("--search <query>", "full-text search").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => docList(ctx, opts));
+});
+doc.command("show").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (id === void 0) throw new UsageError("usage: harness doc show <id>");
+    return docShow(ctx, id);
+  });
+});
+doc.command("create").option("--title <title>", "document title (required)").option("--content <text>").option("--project <id>", "attach to a project").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, true, (ctx) => docCreate(ctx, opts));
+});
+doc.command("update").argument("[id]").option("--title <title>").option("--content <text>").option("--project <id>").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (id === void 0) throw new UsageError("usage: harness doc update <id> --title \u2026 | --content \u2026 | --project \u2026");
+    return docUpdate(ctx, id, opts);
+  });
+});
+var link = program.command("link").description("URLs attached to an issue (distinct from dep relations)");
+link.command("list").argument("[issue]").option("--json", "emit JSON").action(async (issue, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (issue === void 0) throw new UsageError("usage: harness link list <issue>");
+    requireIdentifiers2([issue]);
+    return linkList(ctx, issue);
+  });
+});
+link.command("add").argument("[issue]").argument("[url]").option("--title <title>", "link title").option("--json", "emit JSON").action(async (issue, url, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (issue === void 0 || url === void 0) {
+      throw new UsageError("usage: harness link add <issue> <url> [--title <title>]");
+    }
+    requireIdentifiers2([issue]);
+    return linkAdd(ctx, issue, url, opts.title);
+  });
+});
+link.command("rm").argument("[issue]").argument("[id-or-url]").option("--json", "emit JSON").action(async (issue, idOrUrl, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (issue === void 0 || idOrUrl === void 0) {
+      throw new UsageError("usage: harness link rm <issue> <link-id-or-url>");
+    }
+    requireIdentifiers2([issue]);
+    return linkRm(ctx, issue, idOrUrl);
+  });
+});
+var label = program.command("label").description("labels");
+label.command("list").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => labelList(ctx));
+});
+label.command("create").argument("[name]").option("--color <color>", "label color").option("--json", "emit JSON").action(async (name, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => labelCreate(ctx, name, opts.color));
+});
+var team = program.command("team").description("teams");
+team.command("list").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => teamList(ctx));
+});
+program.command("states").description("a team's workflow states").option("--team <key>", "team key (or HARNESS_TEAM)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => workflowStates(ctx, opts.team));
+});
+var user = program.command("user").description("users");
+user.command("list").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => userList(ctx));
+});
+program.command("upload").description("upload a file; prints markdown to reference it").argument("[path]").option("--json", "emit JSON").action(async (path, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (path === void 0) throw new UsageError("usage: harness upload <path>  (png/jpg/webp/gif, up to 25 MB)");
+    return upload(ctx, path);
+  });
+});
+program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
+  const { startMcpServer } = await import("./server-PI2AZOVY.js");
+  await startMcpServer();
+});
+program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option("--timeout <ms>", "how long to wait for the browser callback", integer).option("--json", "emit JSON").action(async (opts) => {
+  const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
+  const options = { noBrowser: !opts.browser };
+  if (opts.timeout !== void 0) options.timeoutMs = opts.timeout;
+  await finishAuth(await login(url, options), opts.json === true);
+});
+program.command("logout").description("revoke and forget the stored login").option("--json", "emit JSON").action(async (opts) => {
+  await finishAuth(await logout(), opts.json === true);
+});
+program.command("whoami").description("show the resolved host and credential source").option("--json", "emit JSON").action(async (opts) => {
+  const resolved = resolveConfig();
+  if (resolved.kind === "error") {
+    process.stderr.write(`harness: ${resolved.message}
+`);
+    return exitWith(2);
+  }
+  if (resolved.kind === "needs-login") {
+    process.stderr.write(loginHelp(resolved.baseUrl));
+    return exitWith(2);
+  }
+  const source = blankToUndefined(process.env["HARNESS_API_TOKEN"]) !== void 0 ? "environment" : "stored login";
+  await finishAuth(await whoami(resolved.config, source), opts.json === true);
+});
+function storedLoginUrl() {
+  return readCredentials(defaultCredentialsPath())?.url;
+}
+function blankToUndefined(value) {
+  return value === void 0 || value.trim() === "" ? void 0 : value;
+}
+async function finishAuth(result, json2) {
+  if (result.ok) {
+    process.stdout.write(json2 ? json(result.json) : result.human);
+    return exitWith(0);
+  }
+  process.stderr.write(`harness: ${clean(result.message)}
+`);
+  return exitWith(1);
+}
+var argv = process.argv.slice();
+if (argv[2] === "--version" || argv[2] === "-V") argv[2] = "version";
+if (argv.length <= 2) {
+  program.outputHelp({ error: true });
+  await exitWith(2);
+}
+try {
+  await program.parseAsync(argv);
+} catch (error) {
+  if (error instanceof UsageError) {
+    process.stderr.write(error.message + "\n");
+    await exitWith(2);
+  }
+  if (error instanceof CommanderError) {
+    if (error.code === "commander.helpDisplayed" || error.code === "commander.help") {
+      await exitWith(error.exitCode === 0 ? 0 : 2);
+    }
+    await exitWith(2);
+  }
+  throw error;
+}