@allocator-one/harness-cli 1.10.0 → 1.12.0

package/README.md

@@ -39,6 +39,37 @@ Headless contexts (agents, CI): mint an `aone_…` API token (admin → API
 tokens) and set `HARNESS_API_TOKEN`. Do not set it in interactive sessions —
 the browser login attributes writes to the real user.
 
+### Provider keys
+
+Admins store the org's provider API keys (Anthropic, OpenAI, Google,
+OpenRouter, Brave Search, Perplexity) in Harness under `Settings → Model
+keys`. The CLI hands them to tooling without ever printing them:
+
+- `harness keys list` — provider slugs the org has keys for and the env var
+  each maps to (`--json` for `{providers: [{provider, env}]}`); values are
+  never shown.
+- `harness keys exec [--only <slugs>] [--override] -- <command> [args…]` —
+  runs the command with the keys in its environment and exits with the
+  command's exit code (128 + signal number when it was signalled). `--only
+  brave,perplexity` passes just those providers and withholds your shell's
+  own copies of the other provider variables, so the tool sees no more than
+  it needs; a requested provider the org has no key for keeps your shell's
+  variable (and says so on stderr). Slugs are trimmed and case-insensitive,
+  and an allowlist that names nothing (`--only ,`) is a usage error, not
+  "everything". Otherwise a variable already set in your shell wins unless
+  `--override` is given; a blank variable counts as unset. `--json` is
+  accepted for uniformity but changes nothing: stdout belongs to the command. A SIGTERM sent to
+  `harness` is forwarded to the command; Ctrl+C reaches the command from the
+  terminal directly and `harness` waits to report its exit. macOS and Linux
+  only.
+
+Slug → variable, the same table rcl uses: anthropic → `ANTHROPIC_API_KEY`,
+openai → `OPENAI_API_KEY`, google → `GEMINI_API_KEY`, openrouter →
+`OPENROUTER_API_KEY`, brave → `BRAVE_API_KEY`, perplexity →
+`PERPLEXITY_API_KEY`. Reading keys needs the `model-keys:read` scope: login
+tokens carry it, `aone_` tokens must be minted with it. There is deliberately
+no MCP tool for this — a tool result is model-visible text.
+
 ## Environment variables
 
 | Variable | Effect |
@@ -147,6 +178,23 @@ error rather than a silent precedence, and only one field per invocation may
 read stdin. Both are checked before anything is read, so a rejected command
 never consumes your pipe. One trailing newline is dropped, like `$(cat file)`.
 
+## Image and video uploads
+
+`harness upload ./demo.mp4` prints a reusable markdown reference. Paste it
+into an issue description or comment to show an inline video player. Use
+`--json` for the server's URL, filename, content type, byte size, and markdown.
+The MCP `upload` tool accepts the same local path and returns the same metadata.
+
+Images (PNG, JPG, WebP, GIF) can be up to 25 MB. Videos must be `.mp4`, up to
+100 MB, with H.264 8-bit 4:2:0 video, optional AAC audio, and optional mov_text
+subtitles. The server validates the media; it does not transcode other formats.
+
+A newly uploaded video is private to its uploader until that user saves its
+link in an issue description or comment. It then follows the owning issue's
+access policy. Reusing the link elsewhere does not change that ownership.
+`harness show` continues downloading images only, never linked videos.
+The older `attach-image` command retains its 25 MB limit.
+
 ## Repo config
 
 A committed `.harness-cli/config.json`, discovered git-style by walking up

package/dist/{chunk-KKAAKRKF.js → chunk-WY6F3IJB.js}

@@ -444,8 +444,8 @@ function path(record, ...keys) {
 }
 
 // src/commands/issues.ts
-import { openSync, closeSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { basename } from "path";
+import { openAsBlob, openSync, closeSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { basename, extname } from "path";
 
 // src/core/attachments.ts
 import { chmodSync, mkdirSync, renameSync, rmSync, statSync, writeFileSync } from "fs";
@@ -1090,19 +1090,28 @@ function requireCommentId(commentId) {
     throw new UsageError(`not a comment id: ${commentId} (expected a UUID)`);
   }
 }
-var MAX_ATTACHMENT_BYTES2 = 25e6;
+var MAX_IMAGE_BYTES = 25e6;
+var MAX_VIDEO_BYTES = 1e8;
 async function attachImage(ctx, path2) {
-  attachableFile(path2);
-  const bytes = readFileSync2(path2);
+  return uploadAttachment(ctx, path2, MAX_IMAGE_BYTES);
+}
+async function attachFile(ctx, path2) {
+  const maxBytes = extname(path2).toLowerCase() === ".mp4" ? MAX_VIDEO_BYTES : MAX_IMAGE_BYTES;
+  return uploadAttachment(ctx, path2, maxBytes);
+}
+async function uploadAttachment(ctx, path2, maxBytes) {
+  attachableFile(path2, maxBytes);
+  const file = maxBytes === MAX_VIDEO_BYTES ? new File([await openAsBlob(path2)], basename(path2)) : new File([readFileSync2(path2)], basename(path2));
+  requireAttachmentSize(path2, file.size, maxBytes);
   const form = new FormData();
-  form.set("file", new File([bytes], basename(path2)));
-  const body = await ctx.client.postMultipart("/api/v1/uploads", form, bytes.byteLength);
+  form.set("file", file);
+  const body = await ctx.client.postMultipart("/api/v1/uploads", form, file.size);
   const attachment = body.data;
   const markdown = attachment["markdown"];
   if (typeof markdown !== "string") throw new CommandError("the upload response carried no markdown reference");
   return { json: attachment, human: clean(markdown) + "\n" };
 }
-function attachableFile(path2) {
+function attachableFile(path2, maxBytes) {
   let fileStats;
   try {
     fileStats = statSync2(path2);
@@ -1113,17 +1122,18 @@ function attachableFile(path2) {
     const kind = fileStats.isDirectory() ? "directory" : "special file";
     throw new LocalError(`${path2} is a ${kind}, not a file.`);
   }
-  if (fileStats.size > MAX_ATTACHMENT_BYTES2) {
-    throw new LocalError(
-      `${path2} is too large: ${fileStats.size} bytes, and attachments are capped at ${MAX_ATTACHMENT_BYTES2}.`
-    );
-  }
+  requireAttachmentSize(path2, fileStats.size, maxBytes);
   try {
     closeSync(openSync(path2, "r"));
   } catch (error) {
     throw new LocalError(`cannot read ${path2}: ${posixDetail(error)}`);
   }
 }
+function requireAttachmentSize(path2, size, maxBytes) {
+  if (size > maxBytes) {
+    throw new LocalError(`${path2} is too large: ${size} bytes, and attachments are capped at ${maxBytes}.`);
+  }
+}
 function posixDetail(error) {
   const code = error.code;
   if (code === "ENOENT") return "no such file or directory";
@@ -1845,7 +1855,7 @@ function requireYes(command, id, yes) {
   if (yes !== true) throw new UsageError(`${command} ${id} is destructive \u2014 pass --yes to confirm`);
 }
 async function upload(ctx, path2) {
-  return attachImage(ctx, path2);
+  return attachFile(ctx, path2);
 }
 function indent2(text) {
   return cleanMultiline(text).split("\n").map((line) => "  " + line).join("\n");

package/dist/cli.js

@@ -82,12 +82,194 @@ import {
   version,
   workflowStates,
   writeCredentials
-} from "./chunk-KKAAKRKF.js";
+} from "./chunk-WY6F3IJB.js";
 
 // src/cli.ts
 import { createInterface as createInterface2 } from "readline";
 import { Command, CommanderError, InvalidArgumentError } from "commander";
 
+// src/commands/keys.ts
+import { spawn } from "child_process";
+import { constants } from "os";
+var KEY_ENV_VARS = /* @__PURE__ */ new Map([
+  ["anthropic", "ANTHROPIC_API_KEY"],
+  ["openai", "OPENAI_API_KEY"],
+  ["google", "GEMINI_API_KEY"],
+  ["openrouter", "OPENROUTER_API_KEY"],
+  ["brave", "BRAVE_API_KEY"],
+  ["perplexity", "PERPLEXITY_API_KEY"]
+]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function fetchKeys(ctx) {
+  let body;
+  try {
+    body = await ctx.client.get("/api/v1/model-keys");
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 403 && error.message.includes("model-keys:read")) {
+      throw new CommandError(
+        `${error.message} \u2014 login tokens carry model-keys:read; aone_ API tokens must be minted with it`
+      );
+    }
+    throw error;
+  }
+  const data = isRecord(body) ? body["data"] : void 0;
+  const keys2 = isRecord(data) ? data["keys"] : void 0;
+  if (!isRecord(keys2)) throw new CommandError("unexpected model-keys response: no keys map");
+  const stored = /* @__PURE__ */ new Map();
+  for (const [slug, value] of Object.entries(keys2)) {
+    const canonical = slug.trim().toLowerCase();
+    if (stored.has(canonical)) continue;
+    if (typeof value === "string" && value.trim() !== "" && !value.includes("\0")) stored.set(canonical, value);
+  }
+  return stored;
+}
+function envVarFor(slug) {
+  return KEY_ENV_VARS.get(slug.trim().toLowerCase());
+}
+function normalizeSlugs(only) {
+  return [...new Set(only.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""))];
+}
+function selectSlugs(stored, only) {
+  if (only === void 0 || only.length === 0) return new Map(stored);
+  const wanted = new Set(only.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""));
+  return new Map([...stored].filter(([slug]) => wanted.has(slug)));
+}
+function unknownSlugs(only) {
+  return only.map((slug) => slug.trim()).filter((slug) => slug !== "" && !KEY_ENV_VARS.has(slug.toLowerCase()));
+}
+function withholdOthers(base, requested) {
+  const keep = new Set(requested.map((slug) => envVarFor(slug)));
+  const env = { ...base };
+  for (const name of KEY_ENV_VARS.values()) {
+    if (!keep.has(name)) delete env[name];
+  }
+  return env;
+}
+function unstoredSlugs(requested, stored) {
+  const canonical = [...new Set(requested.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""))];
+  return canonical.filter((slug) => !stored.has(slug));
+}
+function toEnv(stored) {
+  const env = {};
+  for (const [slug, value] of stored) {
+    const name = envVarFor(slug);
+    if (name !== void 0) env[name] = value;
+  }
+  return env;
+}
+function childEnv(base, fetched, override) {
+  const env = {};
+  for (const [name, value] of Object.entries(base)) {
+    if (value !== void 0) env[name] = value;
+  }
+  for (const [name, value] of Object.entries(fetched)) {
+    const existing = env[name];
+    if (override || existing === void 0 || existing.trim() === "") env[name] = value;
+  }
+  return env;
+}
+function exitCodeFor(code, signal) {
+  if (code !== null) return code;
+  if (signal !== null) {
+    const number = constants.signals[signal];
+    if (typeof number === "number") return 128 + number;
+  }
+  return 1;
+}
+async function list2(ctx) {
+  const stored = await fetchKeys(ctx);
+  const providers = [...stored.keys()].sort().map((provider) => ({ provider, env: envVarFor(provider) ?? null }));
+  const human = providers.map(({ provider, env }) => `${clean(provider)}	${env ?? "(no env var)"}
+`).join("");
+  return { json: { providers }, human };
+}
+var FORWARDED_SIGNALS = ["SIGTERM"];
+var HELD_SIGNALS = ["SIGINT"];
+async function exec(ctx, opts) {
+  const [program2, ...args] = opts.command;
+  if (program2 === void 0 || program2 === "") {
+    throw new UsageError("keys exec: name the command to run after `--`, e.g. `harness keys exec -- npm test`");
+  }
+  if (process.platform === "win32") {
+    throw new LocalError("keys exec is available on macOS and Linux only");
+  }
+  const onlyGiven = opts.only !== void 0 && opts.only.length > 0;
+  if (onlyGiven && normalizeSlugs(opts.only ?? []).length === 0) {
+    throw new UsageError(`keys exec: --only needs at least one provider slug \u2014 known: ${[...KEY_ENV_VARS.keys()].join(", ")}`);
+  }
+  const unknown = unknownSlugs(opts.only ?? []);
+  if (unknown.length > 0) {
+    throw new UsageError(
+      `keys exec: unknown provider slug ${unknown.map(clean).join(", ")} \u2014 known: ${[...KEY_ENV_VARS.keys()].join(", ")}`
+    );
+  }
+  const stored = await fetchKeys(ctx);
+  const requested = normalizeSlugs(opts.only ?? []);
+  const narrowed = requested.length > 0;
+  if (narrowed) {
+    const missing = unstoredSlugs(requested, stored);
+    if (missing.length > 0) {
+      process.stderr.write(
+        `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
+`
+      );
+    }
+  }
+  const env = childEnv(
+    narrowed ? withholdOthers(process.env, requested) : process.env,
+    toEnv(selectSlugs(stored, requested)),
+    opts.override
+  );
+  const name = clean(program2);
+  const exitCode = await new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(program2, args, { stdio: "inherit", env });
+    } catch (error) {
+      const code = error.code ?? "invalid arguments";
+      reject(new CommandError(`cannot start ${name}: ${code}`));
+      return;
+    }
+    const handlers = [];
+    for (const signal of FORWARDED_SIGNALS) {
+      const handler = () => {
+        child.kill(signal);
+      };
+      process.on(signal, handler);
+      handlers.push([signal, handler]);
+    }
+    for (const signal of HELD_SIGNALS) {
+      const handler = () => {
+      };
+      process.on(signal, handler);
+      handlers.push([signal, handler]);
+    }
+    let settled = false;
+    let spawned = false;
+    const settle = (outcome) => {
+      if (settled) return;
+      settled = true;
+      for (const [signal, handler] of handlers) process.off(signal, handler);
+      outcome();
+    };
+    child.once("spawn", () => {
+      spawned = true;
+    });
+    child.on("error", (error) => {
+      settle(() => {
+        const code = error.code ?? error.message;
+        reject(new CommandError(spawned ? `${name} failed: ${code}` : `cannot run ${name}: ${code}`));
+      });
+    });
+    child.on("exit", (code, signal) => {
+      settle(() => resolve(exitCodeFor(code, signal)));
+    });
+  });
+  return { json: { exit_code: exitCode }, human: "", exitCode };
+}
+
 // src/core/auth.ts
 import { createHash, randomBytes } from "crypto";
 import { execFile } from "child_process";
@@ -744,10 +926,10 @@ function guardBrokenPipes(streams = [process.stdout, process.stderr]) {
 }
 
 // src/core/upgrade.ts
-import { spawn, spawnSync } from "child_process";
+import { spawn as spawn2, spawnSync } from "child_process";
 import {
   accessSync as accessSync2,
-  constants,
+  constants as constants2,
   existsSync,
   linkSync,
   mkdirSync,
@@ -925,7 +1107,7 @@ function spawnRefresh() {
   const self = process.argv[1];
   if (self === void 0 || self === "") return;
   try {
-    const child = spawn(process.execPath, [self, UPDATE_CHECK_COMMAND], {
+    const child = spawn2(process.execPath, [self, UPDATE_CHECK_COMMAND], {
       detached: true,
       stdio: "ignore"
     });
@@ -1046,7 +1228,7 @@ function npmInstallGlobal(install, stillHeld) {
     };
   }
   try {
-    accessSync2(globalRoot, constants.W_OK);
+    accessSync2(globalRoot, constants2.W_OK);
   } catch {
     return {
       ok: false,
@@ -1328,7 +1510,7 @@ async function execute(config, jsonFlag, mutating, run) {
     process.stderr.write(hostNotice);
     if (output.notice !== void 0) process.stderr.write(output.notice);
     process.stdout.write(jsonFlag ? json(output.json) : output.human);
-    return exitWith(output.partial === true ? 1 : 0);
+    return exitWith(output.exitCode ?? (output.partial === true ? 1 : 0));
   } catch (error) {
     return fail(error, hostNotice);
   }
@@ -1901,19 +2083,38 @@ user.command("list").option("--json", "emit JSON").action(async (opts) => {
     (ctx) => userList(ctx)
   );
 });
-program.command("upload").description("upload a file; prints markdown to reference it").argument("[path]").option("--json", "emit JSON").action(async (path, opts) => {
+program.command("upload").description("upload an image (25 MB) or H.264 MP4 video (100 MB, optional AAC audio); prints markdown").argument("[path]").option("--json", "emit JSON").action(async (path, opts) => {
   await withConfig(opts.json === true, true, (ctx) => {
     if (path === void 0)
       throw new UsageError(
-        "usage: harness upload <path>  (png/jpg/webp/gif, up to 25 MB)"
+        "usage: harness upload <path>  (png/jpg/webp/gif up to 25 MB; H.264 MP4 with optional AAC audio up to 100 MB)"
       );
     return upload(ctx, path);
   });
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-QVYSED3Z.js");
+  const { startMcpServer } = await import("./server-5YNUXJO2.js");
   await startMcpServer();
 });
+var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
+keys.command("list").description("provider slugs the org has keys for and the env var each maps to \u2014 never the values").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => list2(ctx));
+});
+keys.command("exec").description(
+  "run a command with the org's keys in its environment and exit with its exit code: harness keys exec [--override] -- <command> [args...]"
+).argument("[command...]", "the command and its arguments").option("--override", "let fetched keys replace variables already set in this shell").option(
+  "--only <slugs>",
+  "pass only these provider slugs (comma-separated, repeatable); default: everything stored",
+  collect,
+  []
+).option("--json", "accepted for uniformity; stdout belongs to the command, so it changes nothing").passThroughOptions().action(async (command, opts) => {
+  const only = opts.only.flatMap((value) => value.split(","));
+  await withConfig(
+    false,
+    false,
+    (ctx) => exec(ctx, { command, override: opts.override === true, only })
+  );
+});
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(
   "--timeout <ms>",
   "how long to wait for the browser callback",

package/dist/{server-QVYSED3Z.js → server-5YNUXJO2.js}

@@ -61,7 +61,7 @@ import {
   upload,
   userList,
   workflowStates
-} from "./chunk-KKAAKRKF.js";
+} from "./chunk-WY6F3IJB.js";
 
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -659,7 +659,7 @@ var TOOLS = [
   // ── Uploads ──
   {
     name: "upload",
-    description: "Upload an image file (png/jpg/webp/gif, \u2264 25 MB) from a local path; returns markdown to reference it in issue fields or comments.",
+    description: "Upload a local image (png/jpg/webp/gif, up to 25 MB) or H.264 MP4 video (8-bit 4:2:0, optional AAC audio and mov_text subtitles, up to 100 MB). Returns metadata and markdown: images use image markdown; videos use ordinary links rendered as inline players in Harness issues. A video is private to its uploader until that user saves its link in an issue description or comment. Reading an issue does not automatically download videos.",
     readOnly: false,
     shape: { path: z.string().describe("local file path") },
     handler: (ctx, args) => upload(ctx, args["path"])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allocator-one/harness-cli",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "description": "CLI and MCP server for Harness, allocator.one's issue tracker",
   "type": "module",
   "license": "MIT",

package/spec/openapi.json

@@ -425,7 +425,7 @@
       "get": {
         "callbacks": {},
         "deprecated": false,
-        "description": "Requires the `harness:read` scope. Streams the attachment bytes (binary response).",
+        "description": "Requires the `harness:read` scope. Streams attachment bytes. Videos recheck the owning organization's and issue's access on every request and use private, no-store caching. Supports one bytes Range: bounded, open-ended, or suffix; returns 206 with Content-Range, or 416 for an unsatisfiable range. Malformed, multipart, and conditional ranges fall back to a full 200. Images retain full-response behavior. Add ?mode=download for attachment disposition.",
         "parameters": [
           {
             "description": "Attachment UUID (the directory segment of the upload's URL)",
@@ -463,6 +463,12 @@
           "404": {
             "description": "Not found"
           },
+          "206": {
+            "description": "Requested video byte range, with Content-Range and Content-Length"
+          },
+          "416": {
+            "description": "Unsatisfiable range; Content-Range contains the actual file size"
+          },
           "422": {
             "description": "Validation error"
           }
@@ -791,7 +797,7 @@
       "post": {
         "callbacks": {},
         "deprecated": false,
-        "description": "Requires the `harness:write` scope. Multipart upload of a png, jpg, webp, or gif (max 25 MB). Returns the attachment URL and a ready-to-paste `![alt](url)` markdown snippet for issue descriptions and comments. Attachments are private: the URL serves admins with a session; API clients fetch the bytes via `GET /api/v1/attachments/{attachment_id}/{file}`.",
+        "description": "Requires the `harness:write` scope. Multipart upload of a png, jpg, webp, or gif (25 MB), or H.264 MP4 video (100 MB; 8-bit 4:2:0 video, optional AAC audio and mov_text subtitles). No transcoding. Returns data.url, filename, content_type, byte_size, and markdown. Images use `![alt](url)`; videos use ordinary `[filename](url)` links. Supply an optional issue identifier to bind the video to that issue's access policy. Without it, the video is private to its uploader until that user saves its link in an issue description or comment. Copying a bound video link does not change its owning issue. Browser URLs require a session; API clients use GET /api/v1/attachments/{attachment_id}/{file} with a read-scoped token bound to the owning organization. Invalid media answers 422; an inaccessible issue answers 404. Existing image access remains unchanged.",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -799,9 +805,13 @@
               "schema": {
                 "properties": {
                   "file": {
-                    "description": "png, jpg, webp, or gif up to 25 MB",
+                    "description": "png, jpg, webp, or gif up to 25 MB; H.264 MP4 up to 100 MB",
                     "format": "binary",
                     "type": "string"
+                  },
+                  "issue": {
+                    "description": "Optional owning issue identifier, for example IO-123. Must be accessible in the token's organization.",
+                    "type": "string"
                   }
                 },
                 "required": [
@@ -836,7 +846,7 @@
             "description": "File storage failed (transient) — retry"
           }
         },
-        "summary": "Upload an image attachment",
+        "summary": "Upload an image or video attachment",
         "tags": []
       }
     },