@allocator-one/harness-cli 1.11.0 → 1.12.1

package/README.md

@@ -39,6 +39,37 @@ Headless contexts (agents, CI): mint an `aone_…` API token (admin → API
 tokens) and set `HARNESS_API_TOKEN`. Do not set it in interactive sessions —
 the browser login attributes writes to the real user.
 
+### Provider keys
+
+Admins store the org's provider API keys (Anthropic, OpenAI, Google,
+OpenRouter, Brave Search, Perplexity) in Harness under `Settings → Model
+keys`. The CLI hands them to tooling without ever printing them:
+
+- `harness keys list` — provider slugs the org has keys for and the env var
+  each maps to (`--json` for `{providers: [{provider, env}]}`); values are
+  never shown.
+- `harness keys exec [--only <slugs>] [--override] -- <command> [args…]` —
+  runs the command with the keys in its environment and exits with the
+  command's exit code (128 + signal number when it was signalled). `--only
+  brave,perplexity` passes just those providers and withholds your shell's
+  own copies of the other provider variables, so the tool sees no more than
+  it needs; a requested provider the org has no key for keeps your shell's
+  variable (and says so on stderr). Slugs are trimmed and case-insensitive,
+  and an allowlist that names nothing (`--only ,`) is a usage error, not
+  "everything". Otherwise a variable already set in your shell wins unless
+  `--override` is given; a blank variable counts as unset. `--json` is
+  accepted for uniformity but changes nothing: stdout belongs to the command. A SIGTERM sent to
+  `harness` is forwarded to the command; Ctrl+C reaches the command from the
+  terminal directly and `harness` waits to report its exit. macOS and Linux
+  only.
+
+Slug → variable, the same table rcl uses: anthropic → `ANTHROPIC_API_KEY`,
+openai → `OPENAI_API_KEY`, google → `GEMINI_API_KEY`, openrouter →
+`OPENROUTER_API_KEY`, brave → `BRAVE_API_KEY`, perplexity →
+`PERPLEXITY_API_KEY`. Reading keys needs the `model-keys:read` scope: login
+tokens carry it, `aone_` tokens must be minted with it. There is deliberately
+no MCP tool for this — a tool result is model-visible text.
+
 ## Environment variables
 
 | Variable | Effect |
@@ -75,7 +106,9 @@ Read the same mixed timeline shown in an issue's Activity section with
 `harness activity IO-123`. It returns the newest 20 entries and points out
 when older entries exist; pass `--all` to follow the opaque cursors through
 the full history. `activity_list` exposes the same `id`, `limit`, and `all`
-inputs to MCP clients.
+inputs to MCP clients. Assignment, reassignment, and unassignment entries show
+the actor and previous/new assignees when supplied by the server. Unavailable
+identities use safe labels rather than raw user ids.
 
 Typed issue relations are available without losing the concise blocking
 workflow. `harness dep add|rm` and the `relation_add`/`relation_rm` MCP tools

package/dist/{chunk-WY6F3IJB.js → chunk-VOH6BBJD.js}

@@ -270,6 +270,8 @@ function activityEntry(entry) {
       return activityComment(entry);
     case "state_event":
       return activityStateEvent(entry);
+    case "assignee_event":
+      return activityAssigneeEvent(entry);
     default:
       throw new CommandError(`Unknown activity entry kind: ${clean(entry["kind"])}`);
   }
@@ -311,6 +313,31 @@ function activityStateEvent(entry) {
   return `[${clean(requiredString(entry["occurred_at"], "activity occurrence time"))}] ${description} \xB7 ${provenance}
 `;
 }
+function activityAssigneeEvent(entry) {
+  const actor = activityActor(requiredRecord(entry["actor"], "activity actor"));
+  const provenance = activityProvenance(requiredRecord(entry["provenance"], "activity provenance"));
+  let description;
+  switch (entry["action"]) {
+    case "assigned":
+      description = `${actor} assigned the issue to ${assigneeName(entry["to_assignee"])}`;
+      break;
+    case "reassigned":
+      description = `${actor} reassigned the issue from ${assigneeName(entry["from_assignee"])} to ${assigneeName(entry["to_assignee"])}`;
+      break;
+    case "unassigned":
+      description = `${actor} unassigned the issue from ${assigneeName(entry["from_assignee"])}`;
+      break;
+    default:
+      throw new CommandError(`Unknown activity action: ${clean(entry["action"])}`);
+  }
+  return `[${clean(requiredString(entry["occurred_at"], "activity occurrence time"))}] ${description} - ${provenance}
+`;
+}
+function assigneeName(value) {
+  const assignee = requiredRecord(value, "activity assignee");
+  if (assignee["kind"] === "unknown") return "Unknown assignee";
+  return activityActor(assignee);
+}
 function activityActor(actor) {
   switch (actor["kind"]) {
     case "user":

package/dist/cli.js

@@ -82,12 +82,194 @@ import {
   version,
   workflowStates,
   writeCredentials
-} from "./chunk-WY6F3IJB.js";
+} from "./chunk-VOH6BBJD.js";
 
 // src/cli.ts
 import { createInterface as createInterface2 } from "readline";
 import { Command, CommanderError, InvalidArgumentError } from "commander";
 
+// src/commands/keys.ts
+import { spawn } from "child_process";
+import { constants } from "os";
+var KEY_ENV_VARS = /* @__PURE__ */ new Map([
+  ["anthropic", "ANTHROPIC_API_KEY"],
+  ["openai", "OPENAI_API_KEY"],
+  ["google", "GEMINI_API_KEY"],
+  ["openrouter", "OPENROUTER_API_KEY"],
+  ["brave", "BRAVE_API_KEY"],
+  ["perplexity", "PERPLEXITY_API_KEY"]
+]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function fetchKeys(ctx) {
+  let body;
+  try {
+    body = await ctx.client.get("/api/v1/model-keys");
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 403 && error.message.includes("model-keys:read")) {
+      throw new CommandError(
+        `${error.message} \u2014 login tokens carry model-keys:read; aone_ API tokens must be minted with it`
+      );
+    }
+    throw error;
+  }
+  const data = isRecord(body) ? body["data"] : void 0;
+  const keys2 = isRecord(data) ? data["keys"] : void 0;
+  if (!isRecord(keys2)) throw new CommandError("unexpected model-keys response: no keys map");
+  const stored = /* @__PURE__ */ new Map();
+  for (const [slug, value] of Object.entries(keys2)) {
+    const canonical = slug.trim().toLowerCase();
+    if (stored.has(canonical)) continue;
+    if (typeof value === "string" && value.trim() !== "" && !value.includes("\0")) stored.set(canonical, value);
+  }
+  return stored;
+}
+function envVarFor(slug) {
+  return KEY_ENV_VARS.get(slug.trim().toLowerCase());
+}
+function normalizeSlugs(only) {
+  return [...new Set(only.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""))];
+}
+function selectSlugs(stored, only) {
+  if (only === void 0 || only.length === 0) return new Map(stored);
+  const wanted = new Set(only.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""));
+  return new Map([...stored].filter(([slug]) => wanted.has(slug)));
+}
+function unknownSlugs(only) {
+  return only.map((slug) => slug.trim()).filter((slug) => slug !== "" && !KEY_ENV_VARS.has(slug.toLowerCase()));
+}
+function withholdOthers(base, requested) {
+  const keep = new Set(requested.map((slug) => envVarFor(slug)));
+  const env = { ...base };
+  for (const name of KEY_ENV_VARS.values()) {
+    if (!keep.has(name)) delete env[name];
+  }
+  return env;
+}
+function unstoredSlugs(requested, stored) {
+  const canonical = [...new Set(requested.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""))];
+  return canonical.filter((slug) => !stored.has(slug));
+}
+function toEnv(stored) {
+  const env = {};
+  for (const [slug, value] of stored) {
+    const name = envVarFor(slug);
+    if (name !== void 0) env[name] = value;
+  }
+  return env;
+}
+function childEnv(base, fetched, override) {
+  const env = {};
+  for (const [name, value] of Object.entries(base)) {
+    if (value !== void 0) env[name] = value;
+  }
+  for (const [name, value] of Object.entries(fetched)) {
+    const existing = env[name];
+    if (override || existing === void 0 || existing.trim() === "") env[name] = value;
+  }
+  return env;
+}
+function exitCodeFor(code, signal) {
+  if (code !== null) return code;
+  if (signal !== null) {
+    const number = constants.signals[signal];
+    if (typeof number === "number") return 128 + number;
+  }
+  return 1;
+}
+async function list2(ctx) {
+  const stored = await fetchKeys(ctx);
+  const providers = [...stored.keys()].sort().map((provider) => ({ provider, env: envVarFor(provider) ?? null }));
+  const human = providers.map(({ provider, env }) => `${clean(provider)}	${env ?? "(no env var)"}
+`).join("");
+  return { json: { providers }, human };
+}
+var FORWARDED_SIGNALS = ["SIGTERM"];
+var HELD_SIGNALS = ["SIGINT"];
+async function exec(ctx, opts) {
+  const [program2, ...args] = opts.command;
+  if (program2 === void 0 || program2 === "") {
+    throw new UsageError("keys exec: name the command to run after `--`, e.g. `harness keys exec -- npm test`");
+  }
+  if (process.platform === "win32") {
+    throw new LocalError("keys exec is available on macOS and Linux only");
+  }
+  const onlyGiven = opts.only !== void 0 && opts.only.length > 0;
+  if (onlyGiven && normalizeSlugs(opts.only ?? []).length === 0) {
+    throw new UsageError(`keys exec: --only needs at least one provider slug \u2014 known: ${[...KEY_ENV_VARS.keys()].join(", ")}`);
+  }
+  const unknown = unknownSlugs(opts.only ?? []);
+  if (unknown.length > 0) {
+    throw new UsageError(
+      `keys exec: unknown provider slug ${unknown.map(clean).join(", ")} \u2014 known: ${[...KEY_ENV_VARS.keys()].join(", ")}`
+    );
+  }
+  const stored = await fetchKeys(ctx);
+  const requested = normalizeSlugs(opts.only ?? []);
+  const narrowed = requested.length > 0;
+  if (narrowed) {
+    const missing = unstoredSlugs(requested, stored);
+    if (missing.length > 0) {
+      process.stderr.write(
+        `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
+`
+      );
+    }
+  }
+  const env = childEnv(
+    narrowed ? withholdOthers(process.env, requested) : process.env,
+    toEnv(selectSlugs(stored, requested)),
+    opts.override
+  );
+  const name = clean(program2);
+  const exitCode = await new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(program2, args, { stdio: "inherit", env });
+    } catch (error) {
+      const code = error.code ?? "invalid arguments";
+      reject(new CommandError(`cannot start ${name}: ${code}`));
+      return;
+    }
+    const handlers = [];
+    for (const signal of FORWARDED_SIGNALS) {
+      const handler = () => {
+        child.kill(signal);
+      };
+      process.on(signal, handler);
+      handlers.push([signal, handler]);
+    }
+    for (const signal of HELD_SIGNALS) {
+      const handler = () => {
+      };
+      process.on(signal, handler);
+      handlers.push([signal, handler]);
+    }
+    let settled = false;
+    let spawned = false;
+    const settle = (outcome) => {
+      if (settled) return;
+      settled = true;
+      for (const [signal, handler] of handlers) process.off(signal, handler);
+      outcome();
+    };
+    child.once("spawn", () => {
+      spawned = true;
+    });
+    child.on("error", (error) => {
+      settle(() => {
+        const code = error.code ?? error.message;
+        reject(new CommandError(spawned ? `${name} failed: ${code}` : `cannot run ${name}: ${code}`));
+      });
+    });
+    child.on("exit", (code, signal) => {
+      settle(() => resolve(exitCodeFor(code, signal)));
+    });
+  });
+  return { json: { exit_code: exitCode }, human: "", exitCode };
+}
+
 // src/core/auth.ts
 import { createHash, randomBytes } from "crypto";
 import { execFile } from "child_process";
@@ -744,10 +926,10 @@ function guardBrokenPipes(streams = [process.stdout, process.stderr]) {
 }
 
 // src/core/upgrade.ts
-import { spawn, spawnSync } from "child_process";
+import { spawn as spawn2, spawnSync } from "child_process";
 import {
   accessSync as accessSync2,
-  constants,
+  constants as constants2,
   existsSync,
   linkSync,
   mkdirSync,
@@ -925,7 +1107,7 @@ function spawnRefresh() {
   const self = process.argv[1];
   if (self === void 0 || self === "") return;
   try {
-    const child = spawn(process.execPath, [self, UPDATE_CHECK_COMMAND], {
+    const child = spawn2(process.execPath, [self, UPDATE_CHECK_COMMAND], {
       detached: true,
       stdio: "ignore"
     });
@@ -1046,7 +1228,7 @@ function npmInstallGlobal(install, stillHeld) {
     };
   }
   try {
-    accessSync2(globalRoot, constants.W_OK);
+    accessSync2(globalRoot, constants2.W_OK);
   } catch {
     return {
       ok: false,
@@ -1328,7 +1510,7 @@ async function execute(config, jsonFlag, mutating, run) {
     process.stderr.write(hostNotice);
     if (output.notice !== void 0) process.stderr.write(output.notice);
     process.stdout.write(jsonFlag ? json(output.json) : output.human);
-    return exitWith(output.partial === true ? 1 : 0);
+    return exitWith(output.exitCode ?? (output.partial === true ? 1 : 0));
   } catch (error) {
     return fail(error, hostNotice);
   }
@@ -1435,7 +1617,7 @@ program.command("show").description("full issue detail; downloads attached image
     });
   }
 );
-program.command("activity").description("mixed issue activity: comments, creation, and state changes").argument("[id]").option(
+program.command("activity").description("mixed issue activity: comments, creation, state and assignee changes").argument("[id]").option(
   "--limit <n>",
   `entries per page (default 20, max ${ACTIVITY_MAX_LIMIT})`,
   activityLimit
@@ -1911,9 +2093,28 @@ program.command("upload").description("upload an image (25 MB) or H.264 MP4 vide
   });
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-5YNUXJO2.js");
+  const { startMcpServer } = await import("./server-FNNMISOZ.js");
   await startMcpServer();
 });
+var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
+keys.command("list").description("provider slugs the org has keys for and the env var each maps to \u2014 never the values").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => list2(ctx));
+});
+keys.command("exec").description(
+  "run a command with the org's keys in its environment and exit with its exit code: harness keys exec [--override] -- <command> [args...]"
+).argument("[command...]", "the command and its arguments").option("--override", "let fetched keys replace variables already set in this shell").option(
+  "--only <slugs>",
+  "pass only these provider slugs (comma-separated, repeatable); default: everything stored",
+  collect,
+  []
+).option("--json", "accepted for uniformity; stdout belongs to the command, so it changes nothing").passThroughOptions().action(async (command, opts) => {
+  const only = opts.only.flatMap((value) => value.split(","));
+  await withConfig(
+    false,
+    false,
+    (ctx) => exec(ctx, { command, override: opts.override === true, only })
+  );
+});
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(
   "--timeout <ms>",
   "how long to wait for the browser callback",

package/dist/{server-5YNUXJO2.js → server-FNNMISOZ.js}

@@ -61,7 +61,7 @@ import {
   upload,
   userList,
   workflowStates
-} from "./chunk-WY6F3IJB.js";
+} from "./chunk-VOH6BBJD.js";
 
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -165,7 +165,7 @@ var TOOLS = [
   },
   {
     name: "activity_list",
-    description: "Mixed issue activity: comments, creation, and state changes. Returns the newest page unless all=true.",
+    description: "Mixed issue activity: comments, creation, state and assignee changes. Returns the newest page unless all=true.",
     readOnly: true,
     shape: {
       id: identifier,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allocator-one/harness-cli",
-  "version": "1.11.0",
+  "version": "1.12.1",
   "description": "CLI and MCP server for Harness, allocator.one's issue tracker",
   "type": "module",
   "license": "MIT",

package/spec/openapi.json

@@ -1297,7 +1297,7 @@
       "get": {
         "callbacks": {},
         "deprecated": false,
-        "description": "Requires the `harness:read` scope. The newest mixed page of comments and issue-state events, returned oldest-first. `has_more` means older entries exist. Pass the opaque `next_cursor` back as `before`; cursors are bound to the issue and viewer and expire after 24 hours.",
+        "description": "Requires the `harness:read` scope. The newest mixed page of comments, issue-state events, and assignee changes, returned oldest-first. `has_more` means older entries exist. Pass the opaque `next_cursor` back as `before`; cursors are bound to the issue and viewer and expire after 24 hours.",
         "parameters": [
           {
             "description": "Issue identifier, e.g. ALL-4901 or CLI-12 (issues minted before team-prefixed numbering carry IO-)",
@@ -1594,6 +1594,131 @@
                               "to_state"
                             ],
                             "type": "object"
+                          },
+                          {
+                            "additionalProperties": false,
+                            "properties": {
+                              "action": {
+                                "enum": [
+                                  "assigned",
+                                  "reassigned",
+                                  "unassigned"
+                                ],
+                                "type": "string"
+                              },
+                              "actor": {
+                                "properties": {
+                                  "kind": {
+                                    "enum": [
+                                      "system",
+                                      "user",
+                                      "deleted_user",
+                                      "unknown"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "name": {
+                                    "nullable": true,
+                                    "type": "string"
+                                  }
+                                },
+                                "required": [
+                                  "kind",
+                                  "name"
+                                ],
+                                "type": "object"
+                              },
+                              "from_assignee": {
+                                "nullable": true,
+                                "properties": {
+                                  "kind": {
+                                    "enum": [
+                                      "system",
+                                      "user",
+                                      "deleted_user",
+                                      "unknown"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "name": {
+                                    "nullable": true,
+                                    "type": "string"
+                                  }
+                                },
+                                "required": [
+                                  "kind",
+                                  "name"
+                                ],
+                                "type": "object"
+                              },
+                              "id": {
+                                "type": "string"
+                              },
+                              "kind": {
+                                "enum": [
+                                  "assignee_event"
+                                ],
+                                "type": "string"
+                              },
+                              "occurred_at": {
+                                "format": "date-time",
+                                "type": "string"
+                              },
+                              "provenance": {
+                                "properties": {
+                                  "kind": {
+                                    "enum": [
+                                      "live",
+                                      "import",
+                                      "backfill"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "witnessed": {
+                                    "type": "boolean"
+                                  }
+                                },
+                                "required": [
+                                  "kind",
+                                  "witnessed"
+                                ],
+                                "type": "object"
+                              },
+                              "to_assignee": {
+                                "nullable": true,
+                                "properties": {
+                                  "kind": {
+                                    "enum": [
+                                      "system",
+                                      "user",
+                                      "deleted_user",
+                                      "unknown"
+                                    ],
+                                    "type": "string"
+                                  },
+                                  "name": {
+                                    "nullable": true,
+                                    "type": "string"
+                                  }
+                                },
+                                "required": [
+                                  "kind",
+                                  "name"
+                                ],
+                                "type": "object"
+                              }
+                            },
+                            "required": [
+                              "id",
+                              "kind",
+                              "occurred_at",
+                              "action",
+                              "actor",
+                              "provenance",
+                              "from_assignee",
+                              "to_assignee"
+                            ],
+                            "type": "object"
                           }
                         ]
                       },