@allocator-one/harness-cli 1.10.0 → 1.11.0

package/README.md

@@ -147,6 +147,23 @@ error rather than a silent precedence, and only one field per invocation may
 read stdin. Both are checked before anything is read, so a rejected command
 never consumes your pipe. One trailing newline is dropped, like `$(cat file)`.
 
+## Image and video uploads
+
+`harness upload ./demo.mp4` prints a reusable markdown reference. Paste it
+into an issue description or comment to show an inline video player. Use
+`--json` for the server's URL, filename, content type, byte size, and markdown.
+The MCP `upload` tool accepts the same local path and returns the same metadata.
+
+Images (PNG, JPG, WebP, GIF) can be up to 25 MB. Videos must be `.mp4`, up to
+100 MB, with H.264 8-bit 4:2:0 video, optional AAC audio, and optional mov_text
+subtitles. The server validates the media; it does not transcode other formats.
+
+A newly uploaded video is private to its uploader until that user saves its
+link in an issue description or comment. It then follows the owning issue's
+access policy. Reusing the link elsewhere does not change that ownership.
+`harness show` continues downloading images only, never linked videos.
+The older `attach-image` command retains its 25 MB limit.
+
 ## Repo config
 
 A committed `.harness-cli/config.json`, discovered git-style by walking up

package/dist/{chunk-KKAAKRKF.js → chunk-WY6F3IJB.js}

@@ -444,8 +444,8 @@ function path(record, ...keys) {
 }
 
 // src/commands/issues.ts
-import { openSync, closeSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { basename } from "path";
+import { openAsBlob, openSync, closeSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { basename, extname } from "path";
 
 // src/core/attachments.ts
 import { chmodSync, mkdirSync, renameSync, rmSync, statSync, writeFileSync } from "fs";
@@ -1090,19 +1090,28 @@ function requireCommentId(commentId) {
     throw new UsageError(`not a comment id: ${commentId} (expected a UUID)`);
   }
 }
-var MAX_ATTACHMENT_BYTES2 = 25e6;
+var MAX_IMAGE_BYTES = 25e6;
+var MAX_VIDEO_BYTES = 1e8;
 async function attachImage(ctx, path2) {
-  attachableFile(path2);
-  const bytes = readFileSync2(path2);
+  return uploadAttachment(ctx, path2, MAX_IMAGE_BYTES);
+}
+async function attachFile(ctx, path2) {
+  const maxBytes = extname(path2).toLowerCase() === ".mp4" ? MAX_VIDEO_BYTES : MAX_IMAGE_BYTES;
+  return uploadAttachment(ctx, path2, maxBytes);
+}
+async function uploadAttachment(ctx, path2, maxBytes) {
+  attachableFile(path2, maxBytes);
+  const file = maxBytes === MAX_VIDEO_BYTES ? new File([await openAsBlob(path2)], basename(path2)) : new File([readFileSync2(path2)], basename(path2));
+  requireAttachmentSize(path2, file.size, maxBytes);
   const form = new FormData();
-  form.set("file", new File([bytes], basename(path2)));
-  const body = await ctx.client.postMultipart("/api/v1/uploads", form, bytes.byteLength);
+  form.set("file", file);
+  const body = await ctx.client.postMultipart("/api/v1/uploads", form, file.size);
   const attachment = body.data;
   const markdown = attachment["markdown"];
   if (typeof markdown !== "string") throw new CommandError("the upload response carried no markdown reference");
   return { json: attachment, human: clean(markdown) + "\n" };
 }
-function attachableFile(path2) {
+function attachableFile(path2, maxBytes) {
   let fileStats;
   try {
     fileStats = statSync2(path2);
@@ -1113,17 +1122,18 @@ function attachableFile(path2) {
     const kind = fileStats.isDirectory() ? "directory" : "special file";
     throw new LocalError(`${path2} is a ${kind}, not a file.`);
   }
-  if (fileStats.size > MAX_ATTACHMENT_BYTES2) {
-    throw new LocalError(
-      `${path2} is too large: ${fileStats.size} bytes, and attachments are capped at ${MAX_ATTACHMENT_BYTES2}.`
-    );
-  }
+  requireAttachmentSize(path2, fileStats.size, maxBytes);
   try {
     closeSync(openSync(path2, "r"));
   } catch (error) {
     throw new LocalError(`cannot read ${path2}: ${posixDetail(error)}`);
   }
 }
+function requireAttachmentSize(path2, size, maxBytes) {
+  if (size > maxBytes) {
+    throw new LocalError(`${path2} is too large: ${size} bytes, and attachments are capped at ${maxBytes}.`);
+  }
+}
 function posixDetail(error) {
   const code = error.code;
   if (code === "ENOENT") return "no such file or directory";
@@ -1845,7 +1855,7 @@ function requireYes(command, id, yes) {
   if (yes !== true) throw new UsageError(`${command} ${id} is destructive \u2014 pass --yes to confirm`);
 }
 async function upload(ctx, path2) {
-  return attachImage(ctx, path2);
+  return attachFile(ctx, path2);
 }
 function indent2(text) {
   return cleanMultiline(text).split("\n").map((line) => "  " + line).join("\n");

package/dist/cli.js

@@ -82,7 +82,7 @@ import {
   version,
   workflowStates,
   writeCredentials
-} from "./chunk-KKAAKRKF.js";
+} from "./chunk-WY6F3IJB.js";
 
 // src/cli.ts
 import { createInterface as createInterface2 } from "readline";
@@ -1901,17 +1901,17 @@ user.command("list").option("--json", "emit JSON").action(async (opts) => {
     (ctx) => userList(ctx)
   );
 });
-program.command("upload").description("upload a file; prints markdown to reference it").argument("[path]").option("--json", "emit JSON").action(async (path, opts) => {
+program.command("upload").description("upload an image (25 MB) or H.264 MP4 video (100 MB, optional AAC audio); prints markdown").argument("[path]").option("--json", "emit JSON").action(async (path, opts) => {
   await withConfig(opts.json === true, true, (ctx) => {
     if (path === void 0)
       throw new UsageError(
-        "usage: harness upload <path>  (png/jpg/webp/gif, up to 25 MB)"
+        "usage: harness upload <path>  (png/jpg/webp/gif up to 25 MB; H.264 MP4 with optional AAC audio up to 100 MB)"
       );
     return upload(ctx, path);
   });
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-QVYSED3Z.js");
+  const { startMcpServer } = await import("./server-5YNUXJO2.js");
   await startMcpServer();
 });
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(

package/dist/{server-QVYSED3Z.js → server-5YNUXJO2.js}

@@ -61,7 +61,7 @@ import {
   upload,
   userList,
   workflowStates
-} from "./chunk-KKAAKRKF.js";
+} from "./chunk-WY6F3IJB.js";
 
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -659,7 +659,7 @@ var TOOLS = [
   // ── Uploads ──
   {
     name: "upload",
-    description: "Upload an image file (png/jpg/webp/gif, \u2264 25 MB) from a local path; returns markdown to reference it in issue fields or comments.",
+    description: "Upload a local image (png/jpg/webp/gif, up to 25 MB) or H.264 MP4 video (8-bit 4:2:0, optional AAC audio and mov_text subtitles, up to 100 MB). Returns metadata and markdown: images use image markdown; videos use ordinary links rendered as inline players in Harness issues. A video is private to its uploader until that user saves its link in an issue description or comment. Reading an issue does not automatically download videos.",
     readOnly: false,
     shape: { path: z.string().describe("local file path") },
     handler: (ctx, args) => upload(ctx, args["path"])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allocator-one/harness-cli",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "CLI and MCP server for Harness, allocator.one's issue tracker",
   "type": "module",
   "license": "MIT",

package/spec/openapi.json

@@ -425,7 +425,7 @@
       "get": {
         "callbacks": {},
         "deprecated": false,
-        "description": "Requires the `harness:read` scope. Streams the attachment bytes (binary response).",
+        "description": "Requires the `harness:read` scope. Streams attachment bytes. Videos recheck the owning organization's and issue's access on every request and use private, no-store caching. Supports one bytes Range: bounded, open-ended, or suffix; returns 206 with Content-Range, or 416 for an unsatisfiable range. Malformed, multipart, and conditional ranges fall back to a full 200. Images retain full-response behavior. Add ?mode=download for attachment disposition.",
         "parameters": [
           {
             "description": "Attachment UUID (the directory segment of the upload's URL)",
@@ -463,6 +463,12 @@
           "404": {
             "description": "Not found"
           },
+          "206": {
+            "description": "Requested video byte range, with Content-Range and Content-Length"
+          },
+          "416": {
+            "description": "Unsatisfiable range; Content-Range contains the actual file size"
+          },
           "422": {
             "description": "Validation error"
           }
@@ -791,7 +797,7 @@
       "post": {
         "callbacks": {},
         "deprecated": false,
-        "description": "Requires the `harness:write` scope. Multipart upload of a png, jpg, webp, or gif (max 25 MB). Returns the attachment URL and a ready-to-paste `![alt](url)` markdown snippet for issue descriptions and comments. Attachments are private: the URL serves admins with a session; API clients fetch the bytes via `GET /api/v1/attachments/{attachment_id}/{file}`.",
+        "description": "Requires the `harness:write` scope. Multipart upload of a png, jpg, webp, or gif (25 MB), or H.264 MP4 video (100 MB; 8-bit 4:2:0 video, optional AAC audio and mov_text subtitles). No transcoding. Returns data.url, filename, content_type, byte_size, and markdown. Images use `![alt](url)`; videos use ordinary `[filename](url)` links. Supply an optional issue identifier to bind the video to that issue's access policy. Without it, the video is private to its uploader until that user saves its link in an issue description or comment. Copying a bound video link does not change its owning issue. Browser URLs require a session; API clients use GET /api/v1/attachments/{attachment_id}/{file} with a read-scoped token bound to the owning organization. Invalid media answers 422; an inaccessible issue answers 404. Existing image access remains unchanged.",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -799,9 +805,13 @@
               "schema": {
                 "properties": {
                   "file": {
-                    "description": "png, jpg, webp, or gif up to 25 MB",
+                    "description": "png, jpg, webp, or gif up to 25 MB; H.264 MP4 up to 100 MB",
                     "format": "binary",
                     "type": "string"
+                  },
+                  "issue": {
+                    "description": "Optional owning issue identifier, for example IO-123. Must be accessible in the token's organization.",
+                    "type": "string"
                   }
                 },
                 "required": [
@@ -836,7 +846,7 @@
             "description": "File storage failed (transient) — retry"
           }
         },
-        "summary": "Upload an image attachment",
+        "summary": "Upload an image or video attachment",
         "tags": []
       }
     },