@allocator-one/harness-cli 1.11.0 → 1.12.0

package/README.md

@@ -39,6 +39,37 @@ Headless contexts (agents, CI): mint an `aone_…` API token (admin → API
 tokens) and set `HARNESS_API_TOKEN`. Do not set it in interactive sessions —
 the browser login attributes writes to the real user.
 
+### Provider keys
+
+Admins store the org's provider API keys (Anthropic, OpenAI, Google,
+OpenRouter, Brave Search, Perplexity) in Harness under `Settings → Model
+keys`. The CLI hands them to tooling without ever printing them:
+
+- `harness keys list` — provider slugs the org has keys for and the env var
+  each maps to (`--json` for `{providers: [{provider, env}]}`); values are
+  never shown.
+- `harness keys exec [--only <slugs>] [--override] -- <command> [args…]` —
+  runs the command with the keys in its environment and exits with the
+  command's exit code (128 + signal number when it was signalled). `--only
+  brave,perplexity` passes just those providers and withholds your shell's
+  own copies of the other provider variables, so the tool sees no more than
+  it needs; a requested provider the org has no key for keeps your shell's
+  variable (and says so on stderr). Slugs are trimmed and case-insensitive,
+  and an allowlist that names nothing (`--only ,`) is a usage error, not
+  "everything". Otherwise a variable already set in your shell wins unless
+  `--override` is given; a blank variable counts as unset. `--json` is
+  accepted for uniformity but changes nothing: stdout belongs to the command. A SIGTERM sent to
+  `harness` is forwarded to the command; Ctrl+C reaches the command from the
+  terminal directly and `harness` waits to report its exit. macOS and Linux
+  only.
+
+Slug → variable, the same table rcl uses: anthropic → `ANTHROPIC_API_KEY`,
+openai → `OPENAI_API_KEY`, google → `GEMINI_API_KEY`, openrouter →
+`OPENROUTER_API_KEY`, brave → `BRAVE_API_KEY`, perplexity →
+`PERPLEXITY_API_KEY`. Reading keys needs the `model-keys:read` scope: login
+tokens carry it, `aone_` tokens must be minted with it. There is deliberately
+no MCP tool for this — a tool result is model-visible text.
+
 ## Environment variables
 
 | Variable | Effect |

package/dist/cli.js

@@ -88,6 +88,188 @@ import {
 import { createInterface as createInterface2 } from "readline";
 import { Command, CommanderError, InvalidArgumentError } from "commander";
 
+// src/commands/keys.ts
+import { spawn } from "child_process";
+import { constants } from "os";
+var KEY_ENV_VARS = /* @__PURE__ */ new Map([
+  ["anthropic", "ANTHROPIC_API_KEY"],
+  ["openai", "OPENAI_API_KEY"],
+  ["google", "GEMINI_API_KEY"],
+  ["openrouter", "OPENROUTER_API_KEY"],
+  ["brave", "BRAVE_API_KEY"],
+  ["perplexity", "PERPLEXITY_API_KEY"]
+]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function fetchKeys(ctx) {
+  let body;
+  try {
+    body = await ctx.client.get("/api/v1/model-keys");
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 403 && error.message.includes("model-keys:read")) {
+      throw new CommandError(
+        `${error.message} \u2014 login tokens carry model-keys:read; aone_ API tokens must be minted with it`
+      );
+    }
+    throw error;
+  }
+  const data = isRecord(body) ? body["data"] : void 0;
+  const keys2 = isRecord(data) ? data["keys"] : void 0;
+  if (!isRecord(keys2)) throw new CommandError("unexpected model-keys response: no keys map");
+  const stored = /* @__PURE__ */ new Map();
+  for (const [slug, value] of Object.entries(keys2)) {
+    const canonical = slug.trim().toLowerCase();
+    if (stored.has(canonical)) continue;
+    if (typeof value === "string" && value.trim() !== "" && !value.includes("\0")) stored.set(canonical, value);
+  }
+  return stored;
+}
+function envVarFor(slug) {
+  return KEY_ENV_VARS.get(slug.trim().toLowerCase());
+}
+function normalizeSlugs(only) {
+  return [...new Set(only.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""))];
+}
+function selectSlugs(stored, only) {
+  if (only === void 0 || only.length === 0) return new Map(stored);
+  const wanted = new Set(only.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""));
+  return new Map([...stored].filter(([slug]) => wanted.has(slug)));
+}
+function unknownSlugs(only) {
+  return only.map((slug) => slug.trim()).filter((slug) => slug !== "" && !KEY_ENV_VARS.has(slug.toLowerCase()));
+}
+function withholdOthers(base, requested) {
+  const keep = new Set(requested.map((slug) => envVarFor(slug)));
+  const env = { ...base };
+  for (const name of KEY_ENV_VARS.values()) {
+    if (!keep.has(name)) delete env[name];
+  }
+  return env;
+}
+function unstoredSlugs(requested, stored) {
+  const canonical = [...new Set(requested.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""))];
+  return canonical.filter((slug) => !stored.has(slug));
+}
+function toEnv(stored) {
+  const env = {};
+  for (const [slug, value] of stored) {
+    const name = envVarFor(slug);
+    if (name !== void 0) env[name] = value;
+  }
+  return env;
+}
+function childEnv(base, fetched, override) {
+  const env = {};
+  for (const [name, value] of Object.entries(base)) {
+    if (value !== void 0) env[name] = value;
+  }
+  for (const [name, value] of Object.entries(fetched)) {
+    const existing = env[name];
+    if (override || existing === void 0 || existing.trim() === "") env[name] = value;
+  }
+  return env;
+}
+function exitCodeFor(code, signal) {
+  if (code !== null) return code;
+  if (signal !== null) {
+    const number = constants.signals[signal];
+    if (typeof number === "number") return 128 + number;
+  }
+  return 1;
+}
+async function list2(ctx) {
+  const stored = await fetchKeys(ctx);
+  const providers = [...stored.keys()].sort().map((provider) => ({ provider, env: envVarFor(provider) ?? null }));
+  const human = providers.map(({ provider, env }) => `${clean(provider)}	${env ?? "(no env var)"}
+`).join("");
+  return { json: { providers }, human };
+}
+var FORWARDED_SIGNALS = ["SIGTERM"];
+var HELD_SIGNALS = ["SIGINT"];
+async function exec(ctx, opts) {
+  const [program2, ...args] = opts.command;
+  if (program2 === void 0 || program2 === "") {
+    throw new UsageError("keys exec: name the command to run after `--`, e.g. `harness keys exec -- npm test`");
+  }
+  if (process.platform === "win32") {
+    throw new LocalError("keys exec is available on macOS and Linux only");
+  }
+  const onlyGiven = opts.only !== void 0 && opts.only.length > 0;
+  if (onlyGiven && normalizeSlugs(opts.only ?? []).length === 0) {
+    throw new UsageError(`keys exec: --only needs at least one provider slug \u2014 known: ${[...KEY_ENV_VARS.keys()].join(", ")}`);
+  }
+  const unknown = unknownSlugs(opts.only ?? []);
+  if (unknown.length > 0) {
+    throw new UsageError(
+      `keys exec: unknown provider slug ${unknown.map(clean).join(", ")} \u2014 known: ${[...KEY_ENV_VARS.keys()].join(", ")}`
+    );
+  }
+  const stored = await fetchKeys(ctx);
+  const requested = normalizeSlugs(opts.only ?? []);
+  const narrowed = requested.length > 0;
+  if (narrowed) {
+    const missing = unstoredSlugs(requested, stored);
+    if (missing.length > 0) {
+      process.stderr.write(
+        `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
+`
+      );
+    }
+  }
+  const env = childEnv(
+    narrowed ? withholdOthers(process.env, requested) : process.env,
+    toEnv(selectSlugs(stored, requested)),
+    opts.override
+  );
+  const name = clean(program2);
+  const exitCode = await new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(program2, args, { stdio: "inherit", env });
+    } catch (error) {
+      const code = error.code ?? "invalid arguments";
+      reject(new CommandError(`cannot start ${name}: ${code}`));
+      return;
+    }
+    const handlers = [];
+    for (const signal of FORWARDED_SIGNALS) {
+      const handler = () => {
+        child.kill(signal);
+      };
+      process.on(signal, handler);
+      handlers.push([signal, handler]);
+    }
+    for (const signal of HELD_SIGNALS) {
+      const handler = () => {
+      };
+      process.on(signal, handler);
+      handlers.push([signal, handler]);
+    }
+    let settled = false;
+    let spawned = false;
+    const settle = (outcome) => {
+      if (settled) return;
+      settled = true;
+      for (const [signal, handler] of handlers) process.off(signal, handler);
+      outcome();
+    };
+    child.once("spawn", () => {
+      spawned = true;
+    });
+    child.on("error", (error) => {
+      settle(() => {
+        const code = error.code ?? error.message;
+        reject(new CommandError(spawned ? `${name} failed: ${code}` : `cannot run ${name}: ${code}`));
+      });
+    });
+    child.on("exit", (code, signal) => {
+      settle(() => resolve(exitCodeFor(code, signal)));
+    });
+  });
+  return { json: { exit_code: exitCode }, human: "", exitCode };
+}
+
 // src/core/auth.ts
 import { createHash, randomBytes } from "crypto";
 import { execFile } from "child_process";
@@ -744,10 +926,10 @@ function guardBrokenPipes(streams = [process.stdout, process.stderr]) {
 }
 
 // src/core/upgrade.ts
-import { spawn, spawnSync } from "child_process";
+import { spawn as spawn2, spawnSync } from "child_process";
 import {
   accessSync as accessSync2,
-  constants,
+  constants as constants2,
   existsSync,
   linkSync,
   mkdirSync,
@@ -925,7 +1107,7 @@ function spawnRefresh() {
   const self = process.argv[1];
   if (self === void 0 || self === "") return;
   try {
-    const child = spawn(process.execPath, [self, UPDATE_CHECK_COMMAND], {
+    const child = spawn2(process.execPath, [self, UPDATE_CHECK_COMMAND], {
       detached: true,
       stdio: "ignore"
     });
@@ -1046,7 +1228,7 @@ function npmInstallGlobal(install, stillHeld) {
     };
   }
   try {
-    accessSync2(globalRoot, constants.W_OK);
+    accessSync2(globalRoot, constants2.W_OK);
   } catch {
     return {
       ok: false,
@@ -1328,7 +1510,7 @@ async function execute(config, jsonFlag, mutating, run) {
     process.stderr.write(hostNotice);
     if (output.notice !== void 0) process.stderr.write(output.notice);
     process.stdout.write(jsonFlag ? json(output.json) : output.human);
-    return exitWith(output.partial === true ? 1 : 0);
+    return exitWith(output.exitCode ?? (output.partial === true ? 1 : 0));
   } catch (error) {
     return fail(error, hostNotice);
   }
@@ -1914,6 +2096,25 @@ program.command("mcp").description("run the MCP server over stdio (for agents)")
   const { startMcpServer } = await import("./server-5YNUXJO2.js");
   await startMcpServer();
 });
+var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
+keys.command("list").description("provider slugs the org has keys for and the env var each maps to \u2014 never the values").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => list2(ctx));
+});
+keys.command("exec").description(
+  "run a command with the org's keys in its environment and exit with its exit code: harness keys exec [--override] -- <command> [args...]"
+).argument("[command...]", "the command and its arguments").option("--override", "let fetched keys replace variables already set in this shell").option(
+  "--only <slugs>",
+  "pass only these provider slugs (comma-separated, repeatable); default: everything stored",
+  collect,
+  []
+).option("--json", "accepted for uniformity; stdout belongs to the command, so it changes nothing").passThroughOptions().action(async (command, opts) => {
+  const only = opts.only.flatMap((value) => value.split(","));
+  await withConfig(
+    false,
+    false,
+    (ctx) => exec(ctx, { command, override: opts.override === true, only })
+  );
+});
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(
   "--timeout <ms>",
   "how long to wait for the browser callback",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allocator-one/harness-cli",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "CLI and MCP server for Harness, allocator.one's issue tracker",
   "type": "module",
   "license": "MIT",