@allocator-one/harness-cli 1.1.0 → 1.2.0

package/README.md

@@ -73,6 +73,24 @@ Auth resolution is identical to the CLI. Without a credential, tools return
 an error telling the agent to run `harness login` in a terminal — the
 server never opens a browser itself.
 
+## Repo config
+
+A committed `.harness-cli/config.json`, discovered git-style by walking up
+from the working directory, gives every clone of a repo its defaults:
+
+```json
+{ "team": "CLI" }
+```
+
+| Field | Effect |
+| --- | --- |
+| `team` | Default team key. Precedence: `--team` > `HARNESS_TEAM` > repo config. |
+| `url` | Target host. `HARNESS_API_URL` wins. Tokens stay host-bound: a stored login only serves the host that minted it, an env `HARNESS_API_TOKEN` refuses to pair with a repo-named host (set `HARNESS_API_URL` explicitly), and before the interactive auto-login opens a browser at a host named only by the repo, the CLI asks once per host (remembered in `~/.config/harness/trusted-hosts.json`). |
+| `org` | Reserved for Harness org-scoping; parsed today, `url` wins meanwhile. |
+
+This is config, not state — issues stay server-side. The escript does not
+read this file (TS-CLI-only).
+
 ## Development
 
 ```sh

package/dist/{chunk-JOT3TGQQ.js → chunk-JMGBMBN6.js}

@@ -1337,18 +1337,119 @@ function deleteCredentials(path2) {
   rmSync2(path2, { force: true });
 }
 
+// src/core/repo-config.ts
+import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, parse } from "path";
+var CONFIG_RELATIVE_PATH = join3(".harness-cli", "config.json");
+function findRepoConfig(startDir = process.cwd()) {
+  let dir = startDir;
+  const { root } = parse(startDir);
+  for (; ; ) {
+    const candidate = join3(dir, CONFIG_RELATIVE_PATH);
+    if (existsSync(candidate)) {
+      return readRepoConfig(candidate);
+    }
+    if (dir === root) return { config: null, warnings: [] };
+    dir = dirname3(dir);
+  }
+}
+function readRepoConfig(path2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(path2, "utf8"));
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { config: null, warnings: [`harness: ignoring malformed ${path2} (${detail})`] };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { config: null, warnings: [`harness: ignoring ${path2} \u2014 expected a JSON object`] };
+  }
+  const record = parsed;
+  const config = { path: path2 };
+  const warnings = [];
+  for (const field2 of ["team", "url", "org"]) {
+    const value = record[field2];
+    if (value === void 0) continue;
+    if (typeof value === "string" && value.trim() !== "") {
+      config[field2] = value.trim();
+    } else {
+      warnings.push(`harness: ignoring "${field2}" in ${path2} \u2014 expected a non-empty string`);
+    }
+  }
+  return { config, warnings };
+}
+function trustedHostsPath(env = process.env) {
+  const xdg = env["XDG_CONFIG_HOME"];
+  const base = xdg !== void 0 && xdg !== "" && isAbsolute2(xdg) ? xdg : join3(homedir2(), ".config");
+  return join3(base, "harness", "trusted-hosts.json");
+}
+function readTrustedHosts(env) {
+  try {
+    const parsed = JSON.parse(readFileSync4(trustedHostsPath(env), "utf8"));
+    if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed["hosts"])) {
+      return parsed["hosts"].filter(
+        (host) => typeof host === "string"
+      );
+    }
+  } catch {
+  }
+  return [];
+}
+function isHostTrusted(baseUrl, env) {
+  return readTrustedHosts(env).includes(baseUrl);
+}
+function trustHost(baseUrl, env) {
+  const hosts = readTrustedHosts(env);
+  if (hosts.includes(baseUrl)) return;
+  const path2 = trustedHostsPath(env);
+  mkdirSync3(dirname3(path2), { recursive: true });
+  writeFileSync3(path2, JSON.stringify({ hosts: [...hosts, baseUrl] }, null, 2) + "\n");
+}
+
 // src/core/config.ts
-import { homedir as homedir2, tmpdir } from "os";
-import { isAbsolute as isAbsolute2, join as join3 } from "path";
+import { homedir as homedir3, tmpdir } from "os";
+import { isAbsolute as isAbsolute3, join as join4 } from "path";
 var DEFAULT_BASE_URL = "https://harness.infra.one";
-function resolveConfig(env = process.env, credentialsPath) {
+function resolveConfig(env = process.env, credentialsPath, repo) {
+  let warnings = [];
+  if (repo === void 0) {
+    const lookup = findRepoConfig();
+    repo = lookup.config;
+    warnings = lookup.warnings;
+  }
   const path2 = credentialsPath ?? defaultCredentialsPath(env);
   const stored = readCredentials(path2);
   const envUrl = blankToNull(env["HARNESS_API_URL"]);
   const envToken = blankToNull(env["HARNESS_API_TOKEN"]);
-  const rawUrl = envUrl ?? (envToken === null && stored !== null ? stored.url : DEFAULT_BASE_URL);
+  const repoUrl = repo?.url?.replace(/\/+$/, "") ?? null;
+  let rawUrl;
+  let hostSource;
+  if (envUrl !== null) {
+    rawUrl = envUrl;
+    hostSource = "env";
+  } else if (envToken !== null) {
+    if (repoUrl !== null && normalize(repoUrl) !== normalize(DEFAULT_BASE_URL)) {
+      return {
+        kind: "error",
+        message: `this repo's config (${repo?.path}) targets ${repoUrl}, but HARNESS_API_TOKEN only travels to the host the environment names \u2014 set HARNESS_API_URL explicitly to pair them`,
+        warnings
+      };
+    }
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
+  } else if (repoUrl !== null) {
+    rawUrl = repoUrl;
+    hostSource = "repo-config";
+  } else if (stored !== null) {
+    rawUrl = stored.url;
+    hostSource = "stored-login";
+  } else {
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
+  }
   const validated = validateBaseUrl(rawUrl);
-  if (!validated.ok) return { kind: "error", message: validated.message };
+  if (!validated.ok) return { kind: "error", message: validated.message, warnings };
   const baseUrl = rawUrl.replace(/\/+$/, "");
   let token;
   if (envToken !== null) {
@@ -1356,7 +1457,9 @@ function resolveConfig(env = process.env, credentialsPath) {
   } else if (stored !== null && normalize(stored.url) !== null && normalize(stored.url) === normalize(baseUrl)) {
     token = stored.token;
   } else {
-    return { kind: "needs-login", baseUrl };
+    const result = { kind: "needs-login", baseUrl, hostSource, warnings };
+    if (hostSource === "repo-config" && repo?.path !== void 0) result.repoConfigPath = repo.path;
+    return result;
   }
   return {
     kind: "ok",
@@ -1364,19 +1467,23 @@ function resolveConfig(env = process.env, credentialsPath) {
       baseUrl,
       token,
       actor: blankToNull(env["HARNESS_ACTOR"]),
-      team: blankToNull(env["HARNESS_TEAM"]),
-      cacheDir: resolveCacheDir(env)
-    }
+      // The committed team is the fallback: the environment (and, above it,
+      // the --team flag at the command layer) stays authoritative.
+      team: blankToNull(env["HARNESS_TEAM"]) ?? repo?.team ?? null,
+      cacheDir: resolveCacheDir(env),
+      hostSource
+    },
+    warnings
   };
 }
 function resolveCacheDir(env = process.env) {
-  return absolute(env["HARNESS_CACHE_DIR"]) ?? join3(cacheHome(env), "harness", "attachments");
+  return absolute(env["HARNESS_CACHE_DIR"]) ?? join4(cacheHome(env), "harness", "attachments");
 }
 function absolute(value) {
-  return value !== void 0 && value !== "" && isAbsolute2(value) ? value : null;
+  return value !== void 0 && value !== "" && isAbsolute3(value) ? value : null;
 }
 function cacheHome(env) {
-  return absolute(env["XDG_CACHE_HOME"]) ?? join3(homedir2() || tmpdir(), ".cache");
+  return absolute(env["XDG_CACHE_HOME"]) ?? join4(homedir3() || tmpdir(), ".cache");
 }
 function normalize(url) {
   let parsed;
@@ -1483,6 +1590,9 @@ export {
   readCredentials,
   writeCredentials,
   deleteCredentials,
+  findRepoConfig,
+  isHostTrusted,
+  trustHost,
   DEFAULT_BASE_URL,
   resolveConfig,
   validateBaseUrl,

package/dist/cli.js

@@ -23,6 +23,8 @@ import {
   docList,
   docShow,
   docUpdate,
+  findRepoConfig,
+  isHostTrusted,
   json,
   labelCreate,
   labelList,
@@ -47,6 +49,7 @@ import {
   stats,
   teamCreate,
   teamList,
+  trustHost,
   update,
   upload,
   userList,
@@ -54,9 +57,10 @@ import {
   version,
   workflowStates,
   writeCredentials
-} from "./chunk-JOT3TGQQ.js";
+} from "./chunk-JMGBMBN6.js";
 
 // src/cli.ts
+import { createInterface as createInterface2 } from "readline";
 import { Command, CommanderError, InvalidArgumentError } from "commander";
 
 // src/core/auth.ts
@@ -314,10 +318,23 @@ async function whoami(config, credentialSource) {
     throw error;
   }
   const serverVersion = await client.serverVersion().catch(() => "unknown");
+  const hostSourceLabels = {
+    env: "HARNESS_API_URL",
+    "repo-config": ".harness-cli/config.json",
+    "stored-login": "stored login",
+    default: "workspace default"
+  };
+  const via = config.hostSource !== void 0 ? ` (via ${hostSourceLabels[config.hostSource]})` : "";
   return {
     ok: true,
-    json: { url: config.baseUrl, source: credentialSource, verified: true, server_version: serverVersion },
-    human: `Host:        ${config.baseUrl}
+    json: {
+      url: config.baseUrl,
+      source: credentialSource,
+      verified: true,
+      server_version: serverVersion,
+      host_source: config.hostSource
+    },
+    human: `Host:        ${config.baseUrl}${via}
 Credential:  ${credentialSource}
 Verified:    ok (server API ${serverVersion})
 `
@@ -354,6 +371,15 @@ function defaultOpenBrowser(url) {
 }
 
 // src/cli.ts
+function promptLine(question) {
+  const readline = createInterface2({ input: process.stdin, output: process.stderr });
+  return new Promise((resolve) => {
+    readline.question(question, (answer) => {
+      readline.close();
+      resolve(answer);
+    });
+  });
+}
 function exitWith(code) {
   const drain = (stream) => new Promise((resolve) => stream.write("", () => resolve()));
   return Promise.all([drain(process.stdout), drain(process.stderr)]).then(() => process.exit(code));
@@ -377,6 +403,7 @@ function interactive() {
 }
 async function withConfig(jsonFlag, mutating, run) {
   const resolved = resolveConfig();
+  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
   if (resolved.kind === "error") {
     process.stderr.write(`harness: ${resolved.message}
 `);
@@ -387,6 +414,19 @@ async function withConfig(jsonFlag, mutating, run) {
       process.stderr.write(loginHelp(resolved.baseUrl));
       return exitWith(2);
     }
+    if (resolved.hostSource === "repo-config" && !isHostTrusted(resolved.baseUrl)) {
+      const answer = await promptLine(
+        `This repo's config (${resolved.repoConfigPath ?? ".harness-cli/config.json"}) targets ${resolved.baseUrl} \u2014 log in there? [y/N] `
+      );
+      if (answer.trim().toLowerCase() !== "y") {
+        process.stderr.write(
+          `harness: not logging in to ${resolved.baseUrl} \u2014 set HARNESS_API_URL to override the repo config
+`
+        );
+        return exitWith(2);
+      }
+      trustHost(resolved.baseUrl);
+    }
     const loginResult = await login(resolved.baseUrl, {});
     if (!loginResult.ok) {
       process.stderr.write(`harness: ${clean(loginResult.message)}
@@ -658,11 +698,18 @@ program.command("upload").description("upload a file; prints markdown to referen
   });
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-GYP5FUKD.js");
+  const { startMcpServer } = await import("./server-W4SXUKVP.js");
   await startMcpServer();
 });
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option("--timeout <ms>", "how long to wait for the browser callback", integer).option("--json", "emit JSON").action(async (opts) => {
-  const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
+  const repoLookup = findRepoConfig();
+  for (const warning of repoLookup.warnings) process.stderr.write(warning + "\n");
+  const repoUrl = repoLookup.config?.url;
+  const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
+  if (url === repoUrl && opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0) {
+    process.stderr.write(`harness: host ${url} comes from ${repoLookup.config?.path}
+`);
+  }
   const options = { noBrowser: !opts.browser };
   if (opts.timeout !== void 0) options.timeoutMs = opts.timeout;
   await finishAuth(await login(url, options), opts.json === true);
@@ -672,6 +719,7 @@ program.command("logout").description("revoke and forget the stored login").opti
 });
 program.command("whoami").description("show the resolved host and credential source").option("--json", "emit JSON").action(async (opts) => {
   const resolved = resolveConfig();
+  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
   if (resolved.kind === "error") {
     process.stderr.write(`harness: ${resolved.message}
 `);

package/dist/{server-GYP5FUKD.js → server-W4SXUKVP.js}

@@ -38,7 +38,7 @@ import {
   upload,
   userList,
   workflowStates
-} from "./chunk-JOT3TGQQ.js";
+} from "./chunk-JMGBMBN6.js";
 
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -48,6 +48,7 @@ var NeedsLoginError = class extends Error {
 };
 function context() {
   const resolved = resolveConfig();
+  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
   if (resolved.kind === "error") throw new NeedsLoginError(resolved.message);
   if (resolved.kind === "needs-login") {
     throw new NeedsLoginError(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allocator-one/harness-cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "CLI and MCP server for Harness, allocator.one's issue tracker",
   "type": "module",
   "license": "MIT",