@allocator-one/harness-cli 1.0.1 → 1.2.0

package/README.md

@@ -56,7 +56,7 @@ tool — issue_list, issue_show, issue_create, issue_update, issue_claim,
 issue_close, issue_comment, relation_add/rm, link_list/add/rm,
 project_list/show/create/update, milestone_list/create,
 document_list/show/create/update, label_list/create, team_list,
-workflow_states, user_list, stats, upload. Read-only tools carry
+team_create, workflow_states, user_list, stats, upload. Read-only tools carry
 `readOnlyHint`. Results are compact JSON of the data envelope.
 
 Register it with Claude Code:
@@ -73,6 +73,24 @@ Auth resolution is identical to the CLI. Without a credential, tools return
 an error telling the agent to run `harness login` in a terminal — the
 server never opens a browser itself.
 
+## Repo config
+
+A committed `.harness-cli/config.json`, discovered git-style by walking up
+from the working directory, gives every clone of a repo its defaults:
+
+```json
+{ "team": "CLI" }
+```
+
+| Field | Effect |
+| --- | --- |
+| `team` | Default team key. Precedence: `--team` > `HARNESS_TEAM` > repo config. |
+| `url` | Target host. `HARNESS_API_URL` wins. Tokens stay host-bound: a stored login only serves the host that minted it, an env `HARNESS_API_TOKEN` refuses to pair with a repo-named host (set `HARNESS_API_URL` explicitly), and before the interactive auto-login opens a browser at a host named only by the repo, the CLI asks once per host (remembered in `~/.config/harness/trusted-hosts.json`). |
+| `org` | Reserved for Harness org-scoping; parsed today, `url` wins meanwhile. |
+
+This is config, not state — issues stay server-side. The escript does not
+read this file (TS-CLI-only).
+
 ## Development
 
 ```sh

package/dist/{chunk-BGBBEM3L.js → chunk-JMGBMBN6.js}

@@ -1250,6 +1250,24 @@ async function labelCreate(ctx, name, color) {
   return { json: response.data, human: `Created label ${clean(response.data["name"])}
 ` };
 }
+var TEAM_CREATE_KEY = /^[A-Za-z][A-Za-z0-9]*$/;
+async function teamCreate(ctx, opts) {
+  if (opts.key === void 0 || opts.name === void 0) {
+    throw new UsageError("usage: harness team create --key <key> --name <name>");
+  }
+  if (!TEAM_CREATE_KEY.test(opts.key)) {
+    throw new UsageError(`not a team key: ${opts.key} (expected e.g. ALL \u2014 letters and digits, letter first)`);
+  }
+  const created = await ctx.client.post("/api/v1/teams", { key: opts.key, name: opts.name });
+  const team = created.data;
+  const states = await ctx.client.get(`/api/v1/teams/${str3(team["key"])}/workflow_states`);
+  const human = `Created team ${str3(team["key"])} \u2014 ${clean(team["name"])}
+` + table(
+    ["NAME", "TYPE"],
+    states.data.map((state) => [str3(state["name"]), str3(state["type"])])
+  );
+  return { json: { ...team, workflow_states: states.data }, human };
+}
 async function teamList(ctx) {
   const body = await ctx.client.get("/api/v1/teams");
   const human = body.data.length === 0 ? "No teams.\n" : table(
@@ -1319,18 +1337,119 @@ function deleteCredentials(path2) {
   rmSync2(path2, { force: true });
 }
 
+// src/core/repo-config.ts
+import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, parse } from "path";
+var CONFIG_RELATIVE_PATH = join3(".harness-cli", "config.json");
+function findRepoConfig(startDir = process.cwd()) {
+  let dir = startDir;
+  const { root } = parse(startDir);
+  for (; ; ) {
+    const candidate = join3(dir, CONFIG_RELATIVE_PATH);
+    if (existsSync(candidate)) {
+      return readRepoConfig(candidate);
+    }
+    if (dir === root) return { config: null, warnings: [] };
+    dir = dirname3(dir);
+  }
+}
+function readRepoConfig(path2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(path2, "utf8"));
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { config: null, warnings: [`harness: ignoring malformed ${path2} (${detail})`] };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { config: null, warnings: [`harness: ignoring ${path2} \u2014 expected a JSON object`] };
+  }
+  const record = parsed;
+  const config = { path: path2 };
+  const warnings = [];
+  for (const field2 of ["team", "url", "org"]) {
+    const value = record[field2];
+    if (value === void 0) continue;
+    if (typeof value === "string" && value.trim() !== "") {
+      config[field2] = value.trim();
+    } else {
+      warnings.push(`harness: ignoring "${field2}" in ${path2} \u2014 expected a non-empty string`);
+    }
+  }
+  return { config, warnings };
+}
+function trustedHostsPath(env = process.env) {
+  const xdg = env["XDG_CONFIG_HOME"];
+  const base = xdg !== void 0 && xdg !== "" && isAbsolute2(xdg) ? xdg : join3(homedir2(), ".config");
+  return join3(base, "harness", "trusted-hosts.json");
+}
+function readTrustedHosts(env) {
+  try {
+    const parsed = JSON.parse(readFileSync4(trustedHostsPath(env), "utf8"));
+    if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed["hosts"])) {
+      return parsed["hosts"].filter(
+        (host) => typeof host === "string"
+      );
+    }
+  } catch {
+  }
+  return [];
+}
+function isHostTrusted(baseUrl, env) {
+  return readTrustedHosts(env).includes(baseUrl);
+}
+function trustHost(baseUrl, env) {
+  const hosts = readTrustedHosts(env);
+  if (hosts.includes(baseUrl)) return;
+  const path2 = trustedHostsPath(env);
+  mkdirSync3(dirname3(path2), { recursive: true });
+  writeFileSync3(path2, JSON.stringify({ hosts: [...hosts, baseUrl] }, null, 2) + "\n");
+}
+
 // src/core/config.ts
-import { homedir as homedir2, tmpdir } from "os";
-import { isAbsolute as isAbsolute2, join as join3 } from "path";
+import { homedir as homedir3, tmpdir } from "os";
+import { isAbsolute as isAbsolute3, join as join4 } from "path";
 var DEFAULT_BASE_URL = "https://harness.infra.one";
-function resolveConfig(env = process.env, credentialsPath) {
+function resolveConfig(env = process.env, credentialsPath, repo) {
+  let warnings = [];
+  if (repo === void 0) {
+    const lookup = findRepoConfig();
+    repo = lookup.config;
+    warnings = lookup.warnings;
+  }
   const path2 = credentialsPath ?? defaultCredentialsPath(env);
   const stored = readCredentials(path2);
   const envUrl = blankToNull(env["HARNESS_API_URL"]);
   const envToken = blankToNull(env["HARNESS_API_TOKEN"]);
-  const rawUrl = envUrl ?? (envToken === null && stored !== null ? stored.url : DEFAULT_BASE_URL);
+  const repoUrl = repo?.url?.replace(/\/+$/, "") ?? null;
+  let rawUrl;
+  let hostSource;
+  if (envUrl !== null) {
+    rawUrl = envUrl;
+    hostSource = "env";
+  } else if (envToken !== null) {
+    if (repoUrl !== null && normalize(repoUrl) !== normalize(DEFAULT_BASE_URL)) {
+      return {
+        kind: "error",
+        message: `this repo's config (${repo?.path}) targets ${repoUrl}, but HARNESS_API_TOKEN only travels to the host the environment names \u2014 set HARNESS_API_URL explicitly to pair them`,
+        warnings
+      };
+    }
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
+  } else if (repoUrl !== null) {
+    rawUrl = repoUrl;
+    hostSource = "repo-config";
+  } else if (stored !== null) {
+    rawUrl = stored.url;
+    hostSource = "stored-login";
+  } else {
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
+  }
   const validated = validateBaseUrl(rawUrl);
-  if (!validated.ok) return { kind: "error", message: validated.message };
+  if (!validated.ok) return { kind: "error", message: validated.message, warnings };
   const baseUrl = rawUrl.replace(/\/+$/, "");
   let token;
   if (envToken !== null) {
@@ -1338,7 +1457,9 @@ function resolveConfig(env = process.env, credentialsPath) {
   } else if (stored !== null && normalize(stored.url) !== null && normalize(stored.url) === normalize(baseUrl)) {
     token = stored.token;
   } else {
-    return { kind: "needs-login", baseUrl };
+    const result = { kind: "needs-login", baseUrl, hostSource, warnings };
+    if (hostSource === "repo-config" && repo?.path !== void 0) result.repoConfigPath = repo.path;
+    return result;
   }
   return {
     kind: "ok",
@@ -1346,19 +1467,23 @@ function resolveConfig(env = process.env, credentialsPath) {
       baseUrl,
       token,
       actor: blankToNull(env["HARNESS_ACTOR"]),
-      team: blankToNull(env["HARNESS_TEAM"]),
-      cacheDir: resolveCacheDir(env)
-    }
+      // The committed team is the fallback: the environment (and, above it,
+      // the --team flag at the command layer) stays authoritative.
+      team: blankToNull(env["HARNESS_TEAM"]) ?? repo?.team ?? null,
+      cacheDir: resolveCacheDir(env),
+      hostSource
+    },
+    warnings
   };
 }
 function resolveCacheDir(env = process.env) {
-  return absolute(env["HARNESS_CACHE_DIR"]) ?? join3(cacheHome(env), "harness", "attachments");
+  return absolute(env["HARNESS_CACHE_DIR"]) ?? join4(cacheHome(env), "harness", "attachments");
 }
 function absolute(value) {
-  return value !== void 0 && value !== "" && isAbsolute2(value) ? value : null;
+  return value !== void 0 && value !== "" && isAbsolute3(value) ? value : null;
 }
 function cacheHome(env) {
-  return absolute(env["XDG_CACHE_HOME"]) ?? join3(homedir2() || tmpdir(), ".cache");
+  return absolute(env["XDG_CACHE_HOME"]) ?? join4(homedir3() || tmpdir(), ".cache");
 }
 function normalize(url) {
   let parsed;
@@ -1456,6 +1581,7 @@ export {
   linkRm,
   labelList,
   labelCreate,
+  teamCreate,
   teamList,
   workflowStates,
   userList,
@@ -1464,6 +1590,9 @@ export {
   readCredentials,
   writeCredentials,
   deleteCredentials,
+  findRepoConfig,
+  isHostTrusted,
+  trustHost,
   DEFAULT_BASE_URL,
   resolveConfig,
   validateBaseUrl,

package/dist/cli.js

@@ -23,6 +23,8 @@ import {
   docList,
   docShow,
   docUpdate,
+  findRepoConfig,
+  isHostTrusted,
   json,
   labelCreate,
   labelList,
@@ -45,7 +47,9 @@ import {
   search,
   show,
   stats,
+  teamCreate,
   teamList,
+  trustHost,
   update,
   upload,
   userList,
@@ -53,9 +57,10 @@ import {
   version,
   workflowStates,
   writeCredentials
-} from "./chunk-BGBBEM3L.js";
+} from "./chunk-JMGBMBN6.js";
 
 // src/cli.ts
+import { createInterface as createInterface2 } from "readline";
 import { Command, CommanderError, InvalidArgumentError } from "commander";
 
 // src/core/auth.ts
@@ -313,10 +318,23 @@ async function whoami(config, credentialSource) {
     throw error;
   }
   const serverVersion = await client.serverVersion().catch(() => "unknown");
+  const hostSourceLabels = {
+    env: "HARNESS_API_URL",
+    "repo-config": ".harness-cli/config.json",
+    "stored-login": "stored login",
+    default: "workspace default"
+  };
+  const via = config.hostSource !== void 0 ? ` (via ${hostSourceLabels[config.hostSource]})` : "";
   return {
     ok: true,
-    json: { url: config.baseUrl, source: credentialSource, verified: true, server_version: serverVersion },
-    human: `Host:        ${config.baseUrl}
+    json: {
+      url: config.baseUrl,
+      source: credentialSource,
+      verified: true,
+      server_version: serverVersion,
+      host_source: config.hostSource
+    },
+    human: `Host:        ${config.baseUrl}${via}
 Credential:  ${credentialSource}
 Verified:    ok (server API ${serverVersion})
 `
@@ -353,6 +371,15 @@ function defaultOpenBrowser(url) {
 }
 
 // src/cli.ts
+function promptLine(question) {
+  const readline = createInterface2({ input: process.stdin, output: process.stderr });
+  return new Promise((resolve) => {
+    readline.question(question, (answer) => {
+      readline.close();
+      resolve(answer);
+    });
+  });
+}
 function exitWith(code) {
   const drain = (stream) => new Promise((resolve) => stream.write("", () => resolve()));
   return Promise.all([drain(process.stdout), drain(process.stderr)]).then(() => process.exit(code));
@@ -376,6 +403,7 @@ function interactive() {
 }
 async function withConfig(jsonFlag, mutating, run) {
   const resolved = resolveConfig();
+  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
   if (resolved.kind === "error") {
     process.stderr.write(`harness: ${resolved.message}
 `);
@@ -386,6 +414,19 @@ async function withConfig(jsonFlag, mutating, run) {
       process.stderr.write(loginHelp(resolved.baseUrl));
       return exitWith(2);
     }
+    if (resolved.hostSource === "repo-config" && !isHostTrusted(resolved.baseUrl)) {
+      const answer = await promptLine(
+        `This repo's config (${resolved.repoConfigPath ?? ".harness-cli/config.json"}) targets ${resolved.baseUrl} \u2014 log in there? [y/N] `
+      );
+      if (answer.trim().toLowerCase() !== "y") {
+        process.stderr.write(
+          `harness: not logging in to ${resolved.baseUrl} \u2014 set HARNESS_API_URL to override the repo config
+`
+        );
+        return exitWith(2);
+      }
+      trustHost(resolved.baseUrl);
+    }
     const loginResult = await login(resolved.baseUrl, {});
     if (!loginResult.ok) {
       process.stderr.write(`harness: ${clean(loginResult.message)}
@@ -640,6 +681,9 @@ var team = program.command("team").description("teams");
 team.command("list").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(opts.json === true, false, (ctx) => teamList(ctx));
 });
+team.command("create").description("create a team, seeded with the default workflow states").option("--key <key>", "identifier prefix for the team's issues, e.g. IOS (required)").option("--name <name>", "display name (required)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, true, (ctx) => teamCreate(ctx, opts));
+});
 program.command("states").description("a team's workflow states").option("--team <key>", "team key (or HARNESS_TEAM)").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(opts.json === true, false, (ctx) => workflowStates(ctx, opts.team));
 });
@@ -654,11 +698,18 @@ program.command("upload").description("upload a file; prints markdown to referen
   });
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-YNJDA7IY.js");
+  const { startMcpServer } = await import("./server-W4SXUKVP.js");
   await startMcpServer();
 });
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option("--timeout <ms>", "how long to wait for the browser callback", integer).option("--json", "emit JSON").action(async (opts) => {
-  const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
+  const repoLookup = findRepoConfig();
+  for (const warning of repoLookup.warnings) process.stderr.write(warning + "\n");
+  const repoUrl = repoLookup.config?.url;
+  const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
+  if (url === repoUrl && opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0) {
+    process.stderr.write(`harness: host ${url} comes from ${repoLookup.config?.path}
+`);
+  }
   const options = { noBrowser: !opts.browser };
   if (opts.timeout !== void 0) options.timeoutMs = opts.timeout;
   await finishAuth(await login(url, options), opts.json === true);
@@ -668,6 +719,7 @@ program.command("logout").description("revoke and forget the stored login").opti
 });
 program.command("whoami").description("show the resolved host and credential source").option("--json", "emit JSON").action(async (opts) => {
   const resolved = resolveConfig();
+  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
   if (resolved.kind === "error") {
     process.stderr.write(`harness: ${resolved.message}
 `);

package/dist/{server-YNJDA7IY.js → server-W4SXUKVP.js}

@@ -32,12 +32,13 @@ import {
   resolveConfig,
   show,
   stats,
+  teamCreate,
   teamList,
   update,
   upload,
   userList,
   workflowStates
-} from "./chunk-BGBBEM3L.js";
+} from "./chunk-JMGBMBN6.js";
 
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -47,6 +48,7 @@ var NeedsLoginError = class extends Error {
 };
 function context() {
   const resolved = resolveConfig();
+  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
   if (resolved.kind === "error") throw new NeedsLoginError(resolved.message);
   if (resolved.kind === "needs-login") {
     throw new NeedsLoginError(
@@ -383,6 +385,16 @@ var TOOLS = [
     shape: {},
     handler: (ctx) => teamList(ctx)
   },
+  {
+    name: "team_create",
+    description: "Create a team. The key becomes the identifier prefix for issues imported under it (upcased, letters/digits, letter first; IO is reserved). The server seeds the default workflow states, so the team is immediately usable.",
+    readOnly: false,
+    shape: {
+      key: z.string().describe("team key, e.g. IOS"),
+      name: z.string().describe("display name")
+    },
+    handler: (ctx, args) => teamCreate(ctx, { key: args["key"], name: args["name"] })
+  },
   {
     name: "workflow_states",
     description: "A team's workflow states (name + type).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allocator-one/harness-cli",
-  "version": "1.0.1",
+  "version": "1.2.0",
   "description": "CLI and MCP server for Harness, allocator.one's issue tracker",
   "type": "module",
   "license": "MIT",

package/spec/openapi.json

@@ -1866,6 +1866,53 @@
         },
         "summary": "List teams",
         "tags": []
+      },
+      "post": {
+        "callbacks": {},
+        "deprecated": false,
+        "description": "Requires the `harness:write` scope. Creates a team seeded with the default workflow states (Backlog, Todo, In Progress, Done, Canceled), so it is immediately usable for the full issue lifecycle. The key is upcased, must match `^[A-Z][A-Z0-9]*$`, and `IO` is reserved for the issues Harness mints.",
+        "parameters": [],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "key": {
+                    "description": "Identifier prefix for issues imported under the team (e.g. ALL). Upcased; create-only.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "type": "string"
+                  }
+                },
+                "type": "object"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "400": {
+            "description": "Bad request"
+          },
+          "401": {
+            "description": "Missing or invalid token"
+          },
+          "403": {
+            "description": "Token not permitted (org-scoped, non-admin, or missing scope)"
+          },
+          "404": {
+            "description": "Not found"
+          },
+          "422": {
+            "description": "Validation error"
+          }
+        },
+        "summary": "Create a team",
+        "tags": []
       }
     },
     "/api/v1/teams/{team_key}/issues": {