@allocator-one/harness-cli 1.14.0 → 1.15.1

package/dist/cli.js

@@ -1,25 +1,36 @@
 #!/usr/bin/env node
 import {
   ACTIVITY_MAX_LIMIT,
-  CLI_VERSION,
   Client,
   CommandError,
   DEFAULT_BASE_URL,
+  EXIT_INTERRUPTED,
+  EXIT_JOB_ENDED,
+  EXIT_WAITING_FOR_PERSON,
+  EXPERT_ASSIGNMENTS_PATH,
+  EXPERT_LAPSED,
   HttpError,
+  JOBS_MAX_LIMIT,
+  JOBS_MAX_PAGES,
+  JOB_STATES,
   LocalError,
   RELATION_CREATE_TYPES,
   RELATION_UPDATE_TYPES,
+  SESSION_PATH,
+  STEER_MAX_CHARACTERS,
   TransportError,
   UpgradeRequiredError,
   UsageError,
   activity,
   archive,
+  assignments,
   attachImage,
   blocked,
   clean,
   close,
   comment,
   comments,
+  conditionList,
   create,
   defaultCredentialsPath,
   deleteComment,
@@ -31,9 +42,21 @@ import {
   docUpdate,
   editComment,
   errorDetails,
+  expertSummary,
+  explainExpertRefusal,
   findRepoConfig,
   gateSet,
+  instructionFrom,
+  isExpertToken,
   isHostTrusted,
+  isLoginCredential,
+  jobCancel,
+  jobContinue,
+  jobPause,
+  jobShow,
+  jobSteer,
+  jobWatch,
+  jobsList,
   json,
   labelCreate,
   labelDelete,
@@ -55,7 +78,11 @@ import {
   planHold,
   planRelease,
   planShow,
+  prepareProcedureRun,
+  prepareRun,
   prime,
+  procedureSave,
+  procedureShow,
   projectCreate,
   projectList,
   projectShow,
@@ -67,17 +94,28 @@ import {
   relationList,
   relationRm,
   relationUpdate,
+  requireCapabilityId,
   requireCloseArgs,
   requireCommentId,
   requireIdentifiers,
+  requireJobId,
+  requireJobsArgs,
   requirePlanId,
+  requireProcedureId,
+  requireProcedureName,
   requireReadyClaimArgs,
+  requireSchemaView,
+  requireSearchQuery,
+  requireToolsOpts,
   requiredTeam,
   resolveCacheHome,
   resolveConfig,
   resolveTextSources,
+  run,
   search,
   show,
+  skillsList,
+  startProcedureRun,
   stateAdd,
   stateDelete,
   stateOrder,
@@ -87,6 +125,10 @@ import {
   teamList,
   teamRename,
   teamSetDefault,
+  toolShow,
+  toolsDomains,
+  toolsList,
+  toolsSearch,
   trustHost,
   update,
   upload,
@@ -94,9 +136,17 @@ import {
   validateBaseUrl,
   validateIdempotencyKey,
   version,
+  watchStopSignal,
   workflowStates,
   writeCredentials
-} from "./chunk-F2YVTB2A.js";
+} from "./chunk-L2OWOZ4N.js";
+import {
+  CLI_VERSION,
+  OPERATOR_PACKAGE,
+  invokedName,
+  layoutOperatorHelp,
+  named
+} from "./chunk-FQWV5MIC.js";
 
 // src/cli.ts
 import { createInterface as createInterface2 } from "readline";
@@ -226,8 +276,10 @@ async function exec(ctx, opts) {
     const missing = unstoredSlugs(requested, stored);
     if (missing.length > 0) {
       process.stderr.write(
-        `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
+        named(
+          `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
 `
+        )
       );
     }
   }
@@ -297,9 +349,10 @@ var RESPONSE_FLUSH_TIMEOUT_MS = 2e3;
 var MAX_PAGE_RESPONSES = 4;
 var loginPageImport;
 function loadLoginPage() {
-  loginPageImport ??= import("./login-page-UVUKFFTT.js");
+  loginPageImport ??= import("./login-page-KGEJFFXR.js");
   return loginPageImport;
 }
+var NO_SESSION = { kind: null, expires_at: null, scopes: null, user: null, org: null };
 function generateState() {
   return randomBytes(24).toString("base64url");
 }
@@ -398,7 +451,7 @@ async function loopbackLogin(baseUrl, options) {
         );
         return token;
       }
-      const result = await verifyAndStore(baseUrl, token.token, options);
+      const result = await verifyAndStore(baseUrl, token.token, options, { minted: true, kind: token.kind });
       if (result.ok) {
         await callback.respond(200, "You can close this browser and return to the terminal.", "success");
       } else {
@@ -451,7 +504,7 @@ function awaitCallback(server, state2, timeoutMs) {
       if (phase !== "waiting") return;
       const timeoutResponse = {
         status: 410,
-        message: "This login attempt has ended \u2014 run harness login again if needed.",
+        message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
         pageState: "error"
       };
       phase = "terminal";
@@ -523,7 +576,7 @@ function awaitCallback(server, state2, timeoutMs) {
         }
         const result = finalResponse ?? {
           status: 410,
-          message: "This login attempt has ended \u2014 run harness login again if needed.",
+          message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
           pageState: "error"
         };
         void trackResponse(respondWithPage(result.status, result.message, result.pageState));
@@ -655,7 +708,8 @@ async function exchangeCode(baseUrl, code, verifier, options) {
   try {
     const body = await bareClient(baseUrl, "", options).post("/api/v1/cli/token-exchange", { code, code_verifier: verifier });
     const token = body.data?.token;
-    if (typeof token === "string" && token !== "") return { ok: true, token };
+    const kind = typeof body.data?.kind === "string" ? body.data.kind : null;
+    if (typeof token === "string" && token !== "") return { ok: true, token, kind };
     return {
       ok: false,
       message: "the login-code exchange returned no token \u2014 aborting"
@@ -679,21 +733,33 @@ async function exchangeCode(baseUrl, code, verifier, options) {
 async function manualLogin(baseUrl, options) {
   const notify = options.notify ?? defaultNotify;
   const prompt = options.prompt ?? defaultPrompt;
-  notify(`Open ${baseUrl}/cli/login in a browser, authorize, and paste the token below.`);
+  notify(
+    `Open ${baseUrl}/cli/login in a browser, authorize, and paste the token below (an outside expert pastes the pxc_ credential minted in their expert view instead).`
+  );
   const token = (await prompt()).trim();
   if (token === "") return { ok: false, message: "no token entered" };
-  return verifyAndStore(baseUrl, token, options);
+  return verifyAndStore(baseUrl, token, options, { minted: false, kind: null });
 }
-async function verifyAndStore(baseUrl, token, options) {
+async function verifyAndStore(baseUrl, token, options, received) {
   const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
   const client = bareClient(baseUrl, token, options);
+  const expert = isExpertToken(token);
+  let kind = received.kind;
   try {
-    await client.get("/api/v1/teams");
+    if (expert) {
+      await client.get(EXPERT_ASSIGNMENTS_PATH);
+    } else {
+      const described = isLoginCredential(token) ? await describeSession(client) : null;
+      if (described === null) await client.get("/api/v1/teams");
+      else kind = described.session.kind ?? kind;
+    }
   } catch (error) {
     if (error instanceof HttpError) {
+      const lapsed = expert && error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : "";
+      const revoked = received.minted && await revokeSession(client, token);
       return {
         ok: false,
-        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored`
+        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored${revoked ? ", and the token was revoked" : ""}${lapsed}`
       };
     }
     if (error instanceof TransportError) {
@@ -709,33 +775,72 @@ async function verifyAndStore(baseUrl, token, options) {
   try {
     writeCredentials(path, baseUrl, token);
   } catch (error) {
-    await client.delete("/api/v1/session").catch(() => void 0);
+    if (received.minted) await revokeSession(client, token);
     const detail = error instanceof Error ? error.message : String(error);
     return {
       ok: false,
-      message: `could not store credentials at ${path}: ${detail}`
+      message: `could not store credentials at ${path}: ${detail}` + (expert ? " (the pxc_ credential is still valid: revoke it in your expert view)" : received.minted ? "" : " (the pasted token was not revoked and stays valid)")
     };
   }
+  let supersededNote = "";
   if (superseded !== null) {
-    await bareClient(superseded.url, superseded.token, options).delete("/api/v1/session").catch(() => void 0);
+    await revokeSession(bareClient(superseded.url, superseded.token, options), superseded.token);
+    if (isExpertToken(superseded.token)) {
+      supersededNote = "The pxc_ credential stored before stays valid until it expires: revoke it in your expert view.\n";
+    }
   }
+  const name = invokedName();
   return {
     ok: true,
-    json: { url: baseUrl, credentials: path },
-    human: `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; harness logout revokes it).
-`
+    json: { url: baseUrl, credentials: path, kind },
+    human: (expert ? `Stored an outside expert's pxc_ credential for ${baseUrl} at ${path} (it lasts at most 30 days; revoke it in your expert view \u2014 ${name} logout only forgets it). Commands now act as the expert: only assignments, conditions and gate work until you log in again.
+` : `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; ${name} logout revokes it).
+`) + kindNote(kind) + supersededNote
+  };
+}
+function kindNote(kind) {
+  if (kind === "operator-cli") {
+    return "This credential is Operator-only (operator-cli): Operator commands work; issue, plan and gate commands are refused.\n";
+  }
+  if (kind === "harness-cli") return "This credential has full access (harness-cli).\n";
+  return "";
+}
+async function describeSession(client) {
+  try {
+    const { envelope, apiVersion } = await client.getVersioned(SESSION_PATH);
+    return { session: sessionOf(envelope.data), apiVersion };
+  } catch (error) {
+    if (error instanceof HttpError && (error.status === 404 || error.status === 405)) return null;
+    throw error;
+  }
+}
+function sessionOf(data) {
+  if (!isRecord2(data)) return NO_SESSION;
+  const text = (value) => typeof value === "string" ? value : null;
+  return {
+    kind: text(data["kind"]),
+    expires_at: text(data["expires_at"]),
+    scopes: Array.isArray(data["scopes"]) ? data["scopes"].filter((scope) => typeof scope === "string") : null,
+    user: isRecord2(data["user"]) ? data["user"] : null,
+    org: isRecord2(data["org"]) ? data["org"] : null
   };
 }
+async function revokeSession(client, token) {
+  if (isExpertToken(token)) return false;
+  return client.delete("/api/v1/session").then(() => true).catch(() => false);
+}
 async function logout(options = {}) {
   const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
   const stored = readCredentials(path);
   if (stored === null) {
+    const envToken = (options.env ?? process.env)["HARNESS_API_TOKEN"] ?? "";
     return {
       ok: false,
-      message: "No stored login to remove. A HARNESS_API_TOKEN from the environment is yours to manage \u2014 unset it, or disable the token in the admin UI."
+      message: "No stored login to remove. A HARNESS_API_TOKEN from the environment is yours to manage \u2014 " + (isExpertToken(envToken.trim()) ? "unset it, or revoke the pxc_ credential in your expert view." : "unset it, or disable the token in the admin UI.")
     };
   }
-  const revoked = await bareClient(stored.url, stored.token, options).delete("/api/v1/session").then(() => true).catch(() => false);
+  const expert = isExpertToken(stored.token);
+  const revoked = await revokeSession(bareClient(stored.url, stored.token, options), stored.token);
   const note = revoked ? "" : " (server-side revoke failed \u2014 the token still expires on its own)";
   try {
     deleteCredentials(path);
@@ -749,24 +854,47 @@ async function logout(options = {}) {
   return {
     ok: true,
     json: { logged_out: true, revoked },
-    human: `Logged out of ${stored.url}${note}.
+    human: expert ? `Forgot the outside expert's pxc_ credential for ${stored.url}. It stays valid until it expires: revoke it in your expert view to end it now.
+` : `Logged out of ${stored.url}${note}.
 `
   };
 }
 async function whoami(config, credentialSource) {
   const client = new Client(config);
+  const expert = isExpertToken(config.token);
+  let probe;
+  let session = null;
+  let serverVersion;
   try {
-    await client.get("/api/v1/stats");
+    const described2 = isLoginCredential(config.token) ? await describeSession(client) : null;
+    if (described2 !== null) {
+      session = described2.session;
+      serverVersion = described2.apiVersion;
+    } else {
+      const answered = await client.getVersioned(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats");
+      probe = answered.envelope.data;
+      serverVersion = answered.apiVersion;
+    }
   } catch (error) {
     if (error instanceof HttpError) {
       return {
         ok: false,
-        message: `signed in to ${config.baseUrl} with a ${credentialSource} credential, but it failed verification: ${error.message} (HTTP ${error.status})`
+        message: expert ? `signed in to ${config.baseUrl} with an outside expert's pxc_ credential (${credentialSource}), but it was refused: ${error.message} (HTTP ${error.status})${error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : ""}` : `signed in to ${config.baseUrl} with a ${credentialSource} credential, but it failed verification: ${error.message} (HTTP ${error.status})`
       };
     }
     throw error;
   }
-  const serverVersion = await client.serverVersion().catch(() => "unknown");
+  let seat = null;
+  if (expert) {
+    seat = expertSeat(probe);
+    if (seat === null) {
+      return {
+        ok: false,
+        message: `signed in to ${config.baseUrl} with an outside expert's pxc_ credential, but the assignments response carried no expert`
+      };
+    }
+  }
+  serverVersion ??= "unknown";
   const hostSourceLabels = {
     env: "HARNESS_API_URL",
     "repo-config": ".harness-cli/config.json",
@@ -774,6 +902,10 @@ async function whoami(config, credentialSource) {
     default: "workspace default"
   };
   const via = config.hostSource !== void 0 ? ` (via ${hostSourceLabels[config.hostSource]})` : "";
+  const expertLines = seat === null ? "" : `Expert:      ${expertSummary(seat)}
+Reaches:     its own assignments and the gates it owns on them (assignments, conditions, gate)
+`;
+  const described = session ?? NO_SESSION;
   return {
     ok: true,
     json: {
@@ -781,14 +913,58 @@ async function whoami(config, credentialSource) {
       source: credentialSource,
       verified: true,
       server_version: serverVersion,
-      host_source: config.hostSource
+      host_source: config.hostSource,
+      kind: described.kind,
+      expires_at: described.expires_at,
+      scopes: described.scopes,
+      user: described.user,
+      org: described.org,
+      expert: seat
     },
     human: `Host:        ${config.baseUrl}${via}
-Credential:  ${credentialSource}
-Verified:    ok (server API ${serverVersion})
+Credential:  ${credentialSource}${seat === null ? "" : ", an outside expert's pxc_ credential"}${kindLabel(described.kind)}
+` + sessionLines(described) + expertLines + `Verified:    ok (server API ${serverVersion})
 `
   };
 }
+function kindLabel(kind) {
+  if (kind === null) return "";
+  if (kind === "harness-cli") return ", harness-cli (full access)";
+  if (kind === "operator-cli") return ", operator-cli (Operator only)";
+  return `, ${clean(kind)}`;
+}
+function sessionLines(session) {
+  let lines = "";
+  const user2 = session.user;
+  if (user2 !== null) {
+    const name = clean(user2["name"]);
+    const email = clean(user2["email"]);
+    lines += `User:        ${name === "" ? email : email === "" ? name : `${name} <${email}>`}
+`;
+  }
+  const org = session.org;
+  if (org !== null) {
+    const name = clean(org["name"]);
+    const slug = clean(org["slug"]);
+    lines += `Org:         ${slug === "" || slug === name ? name : `${name} (${slug})`}
+`;
+  }
+  if (session.expires_at !== null) lines += `Expires:     ${clean(session.expires_at)}
+`;
+  if (session.kind === "operator-cli") {
+    lines += "Reaches:     Operator commands only; issue, plan and gate commands are refused\n";
+  }
+  return lines;
+}
+function expertSeat(data) {
+  if (!isRecord2(data) || !isRecord2(data["expert"])) return null;
+  const plan2 = isRecord2(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
+  const steps = Array.isArray(data["assignments"]) ? data["assignments"].filter(isRecord2).length : 0;
+  return { id: data["expert"]["id"], role: data["expert"]["role"] ?? null, plan: plan2, assigned_steps: steps };
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function bareClient(baseUrl, token, options) {
   const config = {
     baseUrl: baseUrl.replace(/\/+$/, ""),
@@ -801,7 +977,7 @@ function bareClient(baseUrl, token, options) {
   return new Client(config);
 }
 function defaultNotify(line) {
-  process.stderr.write(line + "\n");
+  process.stderr.write(named(line + "\n"));
 }
 function defaultPrompt() {
   const readline = createInterface({
@@ -850,10 +1026,16 @@ import {
 import { basename, dirname, join as join2, parse, sep } from "path";
 import { fileURLToPath } from "url";
 var PACKAGE_NAME = "@allocator-one/harness-cli";
+var PACKAGE_NAMES = [PACKAGE_NAME, OPERATOR_PACKAGE];
 var UPGRADE_INSTALL_SPEC = `${PACKAGE_NAME}@latest`;
+function upgradeInstallSpec(install) {
+  return `${install.packageName ?? PACKAGE_NAME}@latest`;
+}
 var UPDATE_CHECK_COMMAND = "__update-check";
 var REEXEC_SENTINEL = "HARNESS_UPGRADED";
-var DEFAULT_REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
+function latestUrl(packageName = PACKAGE_NAME) {
+  return `https://registry.npmjs.org/${packageName}/latest`;
+}
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var REGISTRY_TIMEOUT_MS = 5e3;
 var NPM_ROOT_TIMEOUT_MS = 15e3;
@@ -866,21 +1048,24 @@ function detectInstall(from = fileURLToPath(import.meta.url)) {
     nodeModules: null
   };
   if (from.split(sep).includes("_npx")) return { ...unknown, kind: "npx" };
-  const packageRoot = findPackageRoot(from);
-  if (packageRoot === null) return unknown;
+  const found = findPackageRoot(from);
+  if (found === null) return unknown;
+  const { packageRoot, packageName } = found;
   if (existsSync(join2(packageRoot, ".git"))) {
-    return { kind: "checkout", packageRoot, nodeModules: null };
+    return { kind: "checkout", packageRoot, packageName, nodeModules: null };
   }
   const nodeModules = enclosingNodeModules(packageRoot);
-  if (nodeModules === null) return { ...unknown, packageRoot };
+  if (nodeModules === null) return { ...unknown, packageRoot, packageName };
   const kind = existsSync(join2(nodeModules, ".bin")) ? "local" : "global";
-  return { kind, packageRoot, nodeModules };
+  return { kind, packageRoot, packageName, nodeModules };
 }
 function findPackageRoot(from) {
   let dir = dirname(from);
   const { root } = parse(dir);
   for (; ; ) {
-    if (packageNameAt(join2(dir, "package.json")) === PACKAGE_NAME) return dir;
+    const name = packageNameAt(join2(dir, "package.json"));
+    if (name !== null && PACKAGE_NAMES.includes(name))
+      return { packageRoot: dir, packageName: name };
     if (dir === root) return null;
     dir = dirname(dir);
   }
@@ -958,12 +1143,15 @@ function comparePrerelease(left, right) {
   }
   return 0;
 }
-function stampPath(env = process.env) {
-  return join2(resolveCacheHome(env), "harness", "update-check.json");
+function stampPath(env = process.env, packageName = PACKAGE_NAME) {
+  const file = packageName === PACKAGE_NAME ? "update-check.json" : `update-check-${packageName.replace(/^@[^/]+\//, "")}.json`;
+  return join2(resolveCacheHome(env), "harness", file);
 }
-function readStamp(env = process.env) {
+function readStamp(env = process.env, packageName = PACKAGE_NAME) {
   try {
-    const parsed = JSON.parse(readFileSync(stampPath(env), "utf8"));
+    const parsed = JSON.parse(
+      readFileSync(stampPath(env, packageName), "utf8")
+    );
     if (typeof parsed !== "object" || parsed === null) return null;
     const record = parsed;
     const checkedAt = record["checkedAt"];
@@ -975,10 +1163,10 @@ function readStamp(env = process.env) {
     return null;
   }
 }
-function writeStamp(stamp, env = process.env) {
-  const path = stampPath(env);
+function writeStamp(stamp, env = process.env, packageName = PACKAGE_NAME) {
+  const path = stampPath(env, packageName);
   const temporary = `${path}.${process.pid}.tmp`;
-  const latest = stamp.latest ?? readStamp(env)?.latest ?? null;
+  const latest = stamp.latest ?? readStamp(env, packageName)?.latest ?? null;
   try {
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(temporary, JSON.stringify({ ...stamp, latest }) + "\n");
@@ -996,9 +1184,10 @@ function updateCheck(options = {}) {
   if (!checksEnabled(env)) return null;
   const install = options.install ?? detectInstall();
   if (install.kind !== "global" && install.kind !== "local") return null;
-  const stamp = readStamp(env);
+  const packageName = install.packageName ?? PACKAGE_NAME;
+  const stamp = readStamp(env, packageName);
   if (stamp === null || now - stamp.checkedAt >= CHECK_INTERVAL_MS) {
-    writeStamp({ checkedAt: now, latest: stamp?.latest ?? null }, env);
+    writeStamp({ checkedAt: now, latest: stamp?.latest ?? null }, env, packageName);
     (options.refresh ?? spawnRefresh)();
   }
   if (stamp !== null && stamp.latest !== null && isNewer(stamp.latest, CLI_VERSION)) {
@@ -1008,7 +1197,7 @@ function updateCheck(options = {}) {
   return null;
 }
 function upgradeHint(install) {
-  return install.kind === "local" ? `npm i ${PACKAGE_NAME}@latest` : `npm i -g ${PACKAGE_NAME}@latest`;
+  return install.kind === "local" ? `npm i ${upgradeInstallSpec(install)}` : `npm i -g ${upgradeInstallSpec(install)}`;
 }
 function spawnRefresh() {
   const self = process.argv[1];
@@ -1024,13 +1213,17 @@ function spawnRefresh() {
   } catch {
   }
 }
-async function performUpdateCheck(env = process.env, now = Date.now()) {
+async function performUpdateCheck(env = process.env, now = Date.now(), packageName = detectInstall().packageName ?? PACKAGE_NAME) {
   if (!checksEnabled(env)) return;
-  writeStamp({ checkedAt: now, latest: await fetchLatestVersion(env) }, env);
+  writeStamp(
+    { checkedAt: now, latest: await fetchLatestVersion(env, packageName) },
+    env,
+    packageName
+  );
 }
-async function fetchLatestVersion(env) {
+async function fetchLatestVersion(env, packageName) {
   const configured = env["HARNESS_REGISTRY_URL"];
-  const url = configured !== void 0 && configured.trim() !== "" ? configured.trim() : DEFAULT_REGISTRY_URL;
+  const url = configured !== void 0 && configured.trim() !== "" ? configured.trim() : latestUrl(packageName);
   try {
     const response = await fetch(url, {
       headers: { accept: "application/json" },
@@ -1148,8 +1341,10 @@ function npmInstallGlobal(install, stillHeld) {
       detail: "lost the upgrade lock while preparing \u2014 another process took over"
     };
   }
-  process.stderr.write(`harness: upgrading ${PACKAGE_NAME} \u2026
-`);
+  process.stderr.write(
+    named(`harness: upgrading ${install.packageName ?? PACKAGE_NAME} \u2026
+`)
+  );
   const args = [
     "install",
     "--global",
@@ -1158,7 +1353,7 @@ function npmInstallGlobal(install, stillHeld) {
     "--no-fund",
     "--no-update-notifier",
     "--loglevel=error",
-    UPGRADE_INSTALL_SPEC
+    upgradeInstallSpec(install)
   ];
   const result = spawnSync(npmCommand(), args, {
     // npm's diagnostics belong on stderr with ours; stdout stays the
@@ -1216,8 +1411,8 @@ function reexecSelf(env, argv2) {
   });
   if (result.error !== void 0) {
     process.stderr.write(
-      `harness: upgraded, but re-running failed: ${result.error.message}
-`
+      named(`harness: upgraded, but re-running failed: ${result.error.message}
+`)
     );
     return 1;
   }
@@ -1320,9 +1515,15 @@ function exitWith(code) {
 }
 guardBrokenPipes();
 var program = new Command();
-program.name("harness").description("issue tracking for humans and agents (harness.infra.one)").exitOverride().configureOutput({
-  writeOut: (text) => process.stdout.write(text),
-  writeErr: (text) => process.stderr.write(text)
+var invokedAs = invokedName();
+function writeStderr(text) {
+  return process.stderr.write(named(text, invokedAs));
+}
+program.name(invokedAs).description(
+  invokedAs === "operator" ? "drive Operator from the terminal and any agent, with Harness issue tracking alongside (harness.infra.one)" : "issue tracking for humans and agents (harness.infra.one)"
+).exitOverride().configureOutput({
+  writeOut: (text) => process.stdout.write(named(text, invokedAs)),
+  writeErr: (text) => writeStderr(text)
 });
 function integer(value) {
   if (!/^\d+$/.test(value))
@@ -1363,17 +1564,17 @@ function interactive() {
   const ci = process.env["CI"];
   return process.stdout.isTTY === true && (ci === void 0 || ci === "");
 }
-async function withConfig(jsonFlag, mutating, run) {
+async function withConfig(jsonFlag, mutating, run2) {
   const resolved = resolveConfig();
-  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
+  for (const warning of resolved.warnings) writeStderr(warning + "\n");
   if (resolved.kind === "error") {
-    process.stderr.write(`harness: ${resolved.message}
+    writeStderr(`harness: ${resolved.message}
 `);
     return exitWith(2);
   }
   if (resolved.kind === "needs-login") {
     if (!interactive()) {
-      process.stderr.write(loginHelp(resolved.baseUrl));
+      writeStderr(loginHelp(resolved.baseUrl));
       return exitWith(2);
     }
     if (resolved.hostSource === "repo-config" && !isHostTrusted(resolved.baseUrl)) {
@@ -1381,7 +1582,7 @@ async function withConfig(jsonFlag, mutating, run) {
         `This repo's config (${resolved.repoConfigPath ?? ".harness-cli/config.json"}) targets ${resolved.baseUrl} \u2014 log in there? [y/N] `
       );
       if (answer.trim().toLowerCase() !== "y") {
-        process.stderr.write(
+        writeStderr(
           `harness: not logging in to ${resolved.baseUrl} \u2014 set HARNESS_API_URL to override the repo config
 `
         );
@@ -1391,49 +1592,49 @@ async function withConfig(jsonFlag, mutating, run) {
     }
     const loginResult = await login(resolved.baseUrl, {});
     if (!loginResult.ok) {
-      process.stderr.write(`harness: ${clean(loginResult.message)}
+      writeStderr(`harness: ${clean(loginResult.message)}
 `);
       return exitWith(1);
     }
-    process.stderr.write(loginResult.human);
+    writeStderr(loginResult.human);
     const again = resolveConfig();
     if (again.kind !== "ok") {
-      process.stderr.write(
+      writeStderr(
         `harness: still not signed in to ${resolved.baseUrl} after logging in
 `
       );
       return exitWith(1);
     }
-    return execute(again.config, jsonFlag, mutating, run);
+    return execute(again.config, jsonFlag, mutating, run2);
   }
-  return execute(resolved.config, jsonFlag, mutating, run);
+  return execute(resolved.config, jsonFlag, mutating, run2);
 }
-async function execute(config, jsonFlag, mutating, run) {
+async function execute(config, jsonFlag, mutating, run2) {
   const client = new Client(config);
   const hostNotice = mutating ? `\u2192 ${config.baseUrl}
 ` : "";
   try {
-    const output = await run({ client, config });
-    process.stderr.write(hostNotice);
-    if (output.notice !== void 0) process.stderr.write(output.notice);
+    const output = await run2({ client, config });
+    writeStderr(hostNotice);
+    if (output.notice !== void 0) writeStderr(output.notice);
     process.stdout.write(jsonFlag ? json(output.json) : output.human);
     return exitWith(output.exitCode ?? (output.partial === true ? 1 : 0));
   } catch (error) {
-    return fail(error, hostNotice);
+    return fail(explainExpertRefusal(error, config.token), hostNotice);
   }
 }
 async function fail(error, hostNotice) {
   if (error instanceof UsageError) {
-    process.stderr.write(error.message + "\n");
+    writeStderr(error.message + "\n");
     return exitWith(2);
   }
   if (error instanceof LocalError) {
-    process.stderr.write(`harness: ${clean(error.message)}
+    writeStderr(`harness: ${clean(error.message)}
 `);
     return exitWith(1);
   }
   if (error instanceof TransportError) {
-    process.stderr.write(
+    writeStderr(
       hostNotice + `harness: cannot reach the API: ${clean(error.message)}
 `
     );
@@ -1443,21 +1644,21 @@ async function fail(error, hostNotice) {
     const healed = selfHeal();
     if (healed.kind === "upgraded") return exitWith(healed.code);
     const why = healed.kind === "failed" ? ` (tried to upgrade: ${clean(healed.reason)})` : "";
-    process.stderr.write(
+    writeStderr(
       hostNotice + `harness: ${clean(error.message)} (HTTP 426)${why}
 `
     );
     return exitWith(1);
   }
   if (error instanceof HttpError) {
-    process.stderr.write(
+    writeStderr(
       hostNotice + `harness: ${clean(error.message)} (HTTP ${error.status})${errorDetails(error.body)}
 `
     );
     return exitWith(1);
   }
   if (error instanceof CommandError) {
-    process.stderr.write(hostNotice + `harness: ${clean(error.message)}
+    writeStderr(hostNotice + `harness: ${clean(error.message)}
 `);
     return exitWith(1);
   }
@@ -1518,7 +1719,7 @@ program.command("show").description("full issue detail; downloads attached image
     });
   }
 );
-program.command("activity").description("mixed issue activity: comments, creation, state and assignee changes").argument("[id]").option(
+program.command("activity").description("mixed issue activity: comments, creation, state, assignee, wait-condition and field changes").argument("[id]").option(
   "--limit <n>",
   `entries per page (default 20, max ${ACTIVITY_MAX_LIMIT})`,
   activityLimit
@@ -1759,15 +1960,213 @@ for (const [verb, satisfied] of [
   ["satisfy", true],
   ["unsatisfy", false]
 ]) {
-  gate.command(verb).description(`${satisfied ? "tick" : "untick"} a gate on an issue, by its label or condition id`).argument("[issue]").argument("[gate]").option("--json", "emit JSON").action(async (issue, gateName, opts) => {
+  gate.command(verb).description(`${satisfied ? "tick" : "untick"} a gate on an issue, by its key, label or condition id`).argument("[issue]").argument("[gate]").option("--json", "emit JSON").action(async (issue, gateName, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
       if (issue === void 0 || gateName === void 0) {
-        throw new UsageError(`usage: harness gate ${verb} <issue> <gate-label-or-id>`);
+        throw new UsageError(`usage: harness gate ${verb} <issue> <gate-key-label-or-id>`);
       }
       return gateSet(ctx, issue, gateName, satisfied);
     });
   });
 }
+program.command("conditions").description("an issue's wait conditions; with an outside expert's pxc_ credential, the gates they own on it").argument("[issue]").option("--json", "emit JSON").action(async (issue, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (issue === void 0) throw new UsageError("usage: harness conditions <issue>");
+    return conditionList(ctx, issue);
+  });
+});
+program.command("assignments").description("an outside expert's steps and the gates they own on them (pxc_ credentials only)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => assignments(ctx));
+});
+var NO_OBJECTIVE_TEXT = "By reference only: never the objective's text, which the API does not return because it can quote what Operator read; the workbench link opens it. Approval happens in the app.";
+program.command("jobs").description("Operator jobs you see in the workbench, newest first").option(
+  "--status <states>",
+  `comma-separated job states (${JOB_STATES.join(", ")}) or open | waiting | done`
+).option("--mine", "only jobs you own").option(`--limit <n>`, `jobs per page (default 20, max ${JOBS_MAX_LIMIT})`, integer).option("--all", `follow every page (up to ${JOBS_MAX_PAGES})`).option("--json", "emit JSON").addHelpText("after", `
+${NO_OBJECTIVE_TEXT}
+`).action(async (opts) => {
+  requireJobsArgs(opts);
+  await withConfig(opts.json === true, false, (ctx) => jobsList(ctx, opts));
+});
+program.command("job").description("one Operator job: status, plan, progress, window, spend, approval link, effects, artifacts, people").argument("[id]").option("--changes", "instead, its change set by reference (never values or targets), with the approval link").option("--people", "instead, who is on it by name: requester, execution principal, owner, approvers, collaborators").option("--json", "emit JSON").addHelpText("after", `
+${NO_OBJECTIVE_TEXT}
+`).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness job <job-id> [--changes] [--people]");
+  requireJobId(id);
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => jobShow(ctx, id, { changes: opts.changes, people: opts.people })
+  );
+});
+program.command("watch").description("follow an Operator job until it completes, fails, or waits for a person").argument("[id]").option("--after <seq>", "start after this event sequence (default 0: the whole history)", integer).option("--through-waits", "keep following while a person has to act, instead of stopping").option("--json", "emit one JSON document when the watch ends").addHelpText(
+  "after",
+  `
+Polls the job's events every 2 s, and every 10 s while the job is paused or
+a person has to act. A person has to act exactly when the job's waiting_on is
+set: an approval, a person, reconciliation, verification or delivery. A job
+paused with nothing for a person to do resumes by itself, so watch follows it.
+It only reads: approval happens in the app, and the approval link is printed.
+A failed poll is retried 3 times (1, 2, 4 s, or the server's Retry-After).
+
+Exit codes:
+  0    the job completed (or stdout's reader went away, e.g. | head)
+  ${EXIT_WAITING_FOR_PERSON}    a person has to act (not with --through-waits); the link is printed
+  ${EXIT_JOB_ENDED}    the job failed or was cancelled
+  ${EXIT_INTERRUPTED}  interrupted with Ctrl-C; stderr says where to resume (--after)
+  1, 3 as for every command: an API error, or the API unreachable after the retries;
+       stderr says where to resume, and --json still prints the events read so far
+  2    a usage error
+`
+).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness watch <job-id>");
+  requireJobId(id);
+  const json2 = opts.json === true;
+  await withConfig(
+    json2,
+    false,
+    (ctx) => jobWatch(ctx, id, {
+      after: opts.after,
+      throughWaits: opts.throughWaits === true,
+      collectEvents: json2,
+      onLine: json2 ? void 0 : (line) => process.stdout.write(line),
+      signal: watchStopSignal()
+    })
+  );
+});
+var NOT_RETRIED = `
+Not idempotent, so it is never retried, not even after a timeout or a server
+error. When a failure leaves the outcome unknown it says so and exits 1:
+check \`job <id>\` before trying again. Exit 3 means the request never
+reached the server, so nothing changed. It answers the job as \`job\` shows
+it. Approving stays in the app.
+`;
+program.command("steer").description("post an instruction to an Operator job, as Steer does in the app; earlier approvals stop applying").argument("[id]").argument("[instruction...]").option("--instruction-file <path>", 'read the instruction from a file ("-" for stdin)').option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Posts the instruction in the job's room, attributed to you, wherever the app
+offers Steer; the job's owner and collaborators may steer. Work it changes
+needs a fresh approval, and a running job stops its current run to take it.
+At most ${STEER_MAX_CHARACTERS} characters once trimmed.
+
+Quote the instruction: unquoted words that look like options (--json, --help)
+are read as options, not text. Put -- before an instruction that starts with
+"-", or pass it with --instruction-file, which takes any text as it is.
+${NOT_RETRIED}`
+).action(async (id, words, opts) => {
+  if (id === void 0 || words.length === 0 && opts.instructionFile === void 0) {
+    throw new UsageError(
+      "usage: harness steer <job-id> <instruction> | harness steer <job-id> --instruction-file <path>"
+    );
+  }
+  requireJobId(id);
+  const instruction = instructionFrom(words, opts.instructionFile);
+  await withConfig(opts.json === true, true, (ctx) => jobSteer(ctx, id, instruction));
+});
+program.command("cancel").description("cancel an Operator job; committed effects stay committed, and their counts are printed").argument("[id]").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Ends the job, as Cancel does in the app; only its execution principal may.
+Staged effects that never ran count as unknown.
+${NOT_RETRIED}`
+).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness cancel <job-id>");
+  requireJobId(id);
+  await withConfig(opts.json === true, true, (ctx) => jobCancel(ctx, id));
+});
+program.command("pause").description("pause a running Operator job for a person, keeping its active-time budget").argument("[id]").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Holds the job, as Pause does in the app; only its execution principal may.
+Continue it to run again.
+${NOT_RETRIED}`
+).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness pause <job-id>");
+  requireJobId(id);
+  await withConfig(opts.json === true, true, (ctx) => jobPause(ctx, id));
+});
+var NOT_IDEMPOTENT = "Not idempotent: it is sent once and never retried, not after a timeout or a 5xx either. Exit 3 means the request never reached the server, so nothing changed. When it may have, the outcome is unknown: it exits 1 and says so. Then check";
+program.command("run").description("start an Operator job from an outcome, as Run as job does in the app; --watch follows it").argument("[outcome...]").option("--budget <usd>", "US dollars the organization's monthly Operator budget must still have (admins only)", once("--budget")).option("--skill <name>", "run one of the organization's Operator skills, by invocation name (/name)", once("--skill")).option("--watch", "follow the job like `watch --through-waits`; it never approves").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Starts a job for you in a new org chat of yours, under your own current rights.
+Prints the job id, its state and its workbench link, and the approval link
+while a change set waits for approval. Approving happens in the app; the CLI
+never approves. You can start 30 jobs an hour. ${NOT_IDEMPOTENT} \`jobs --mine\` for the new job before running it again.
+
+With --watch the job is followed until it completes (exit 0) or fails or is
+cancelled (exit ${EXIT_JOB_ENDED}). When it waits for a person, the approval link is printed and the
+watch keeps waiting; Ctrl-C stops it (exit ${EXIT_INTERRUPTED}) and stderr says how to resume.
+`
+).action(async (words, opts) => {
+  const request = prepareRun(words.join(" "), { budget: opts.budget, skill: opts.skill });
+  const json2 = opts.json === true;
+  await withConfig(
+    json2,
+    true,
+    (ctx) => run(ctx, request, {
+      watch: opts.watch === true,
+      json: json2,
+      onLine: (line) => process.stdout.write(line),
+      signal: opts.watch === true ? watchStopSignal() : void 0
+    })
+  );
+});
+function once(flag) {
+  return (value, previous) => {
+    if (previous !== void 0) throw new InvalidArgumentError(`${flag} given twice \u2014 pass it once`);
+    return value;
+  };
+}
+program.command("continue").description(
+  "open a new audited window for an Operator job that ran out of time or waits on a person, as Continue does in the app"
+).argument("[id]").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Only the job's execution principal, the person it runs as, may continue it. ${NOT_IDEMPOTENT} \`job <id>\` before continuing it again.
+`
+).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness continue <job-id>");
+  requireJobId(id);
+  await withConfig(opts.json === true, true, (ctx) => jobContinue(ctx, id));
+});
+var procedure = program.command("procedure").description("saved Operator procedures: procedure save|show|run");
+procedure.command("save").description("save a completed, verified job as a procedure, as Save procedure does in the app (its owner only)").argument("[job-id]").option("--name <name>", "the procedure's name (trimmed, at most 200 characters)", once("--name")).option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Saving again saves another procedure. ${NOT_IDEMPOTENT} the job's procedures (\`job <id>\`) before saving it again.
+`
+).action(async (jobId, opts) => {
+  if (jobId === void 0) throw new UsageError('usage: harness procedure save <job-id> --name "\u2026"');
+  requireJobId(jobId);
+  const name = requireProcedureName(opts.name);
+  await withConfig(opts.json === true, true, (ctx) => procedureSave(ctx, jobId, name));
+});
+procedure.command("show").description("one procedure: its source job, versions (digest, capabilities, actions) and the parameters a run takes").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness procedure show <procedure-id>");
+  requireProcedureId(id);
+  await withConfig(opts.json === true, false, (ctx) => procedureShow(ctx, id));
+});
+procedure.command("run").description("run a procedure as a new job, with fresh inputs, your current rights and an approval of its own in the app").argument("[id]").option("--version <n>", "the version expected to be current (default: whichever is current)", once("--version")).option("--param <name=value>", "a parameter, as a string; name:=<json> for a JSON value (repeatable)", collect, []).option("--params-file <path>", 'the parameters as one JSON object ("-" for stdin)', once("--params-file")).option("--group <id>", "the contact group to reconcile, when the procedure needs one", once("--group")).option("--source <id>", "the uploaded file to reconcile against, when the procedure needs one", once("--source")).option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Nothing of the saved job carries over: no grant, approval, delegation, collaborator or read material. Approving happens in the app. ${NOT_IDEMPOTENT} \`jobs\` for the new job before running it again.
+`
+).action(
+  async (id, opts) => {
+    if (id === void 0) {
+      throw new UsageError("usage: harness procedure run <procedure-id> [--version N] [--param name=value]\u2026");
+    }
+    const request = prepareProcedureRun(id, {
+      version: opts.version,
+      param: opts.param,
+      paramsFile: opts.paramsFile,
+      group: opts.group,
+      source: opts.source
+    });
+    await withConfig(opts.json === true, true, (ctx) => startProcedureRun(ctx, request));
+  }
+);
 var commentCommand = program.command("comment").description("comment on an issue").argument("[id]").argument("[text...]").option("--body-file <path>", 'read the comment body from a file ("-" for stdin)').option("--mention <name>", "notify a person (repeatable)", collect, []).option("--json", "emit JSON").action(
   async (id, text, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
@@ -2047,9 +2446,40 @@ program.command("upload").description("upload an image (25 MB) or H.264 MP4 vide
     return upload(ctx, path);
   });
 });
+var tools = program.command("tools").description(
+  "the capabilities Operator can use now in this organization (switched-off ones never appear); write and send capabilities need approval in the app"
+).option("--domain <domain>", "only this domain (`tools domains` lists them)").option("--cursor <cursor>", "continue from a page's cursor (from the paging notice)").option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  requireToolsOpts(opts);
+  await withConfig(opts.json === true, false, (ctx) => toolsList(ctx, opts));
+});
+tools.command("search").description("search what Operator can use now by keyword, best match first").argument("[query...]").option("--domain <domain>", "only this domain").option("--cursor <cursor>", "continue from a page's cursor (from the paging notice)").option("--all", "follow every page").option("--json", "emit JSON").action(async (query, opts) => {
+  const merged = { ...tools.opts(), ...opts };
+  if (query.length === 0) {
+    throw new UsageError("usage: harness tools search <query> [--domain <domain>] [--all]");
+  }
+  requireSearchQuery(query.join(" "));
+  requireToolsOpts(merged);
+  await withConfig(merged.json === true, false, (ctx) => toolsSearch(ctx, query.join(" "), merged));
+});
+tools.command("domains").description("every domain Operator can use capabilities in, with how many").option("--json", "emit JSON").action(async (opts) => {
+  const parent = tools.opts();
+  if (parent.domain !== void 0 || parent.cursor !== void 0 || parent.all === true) {
+    throw new UsageError("usage: harness tools domains [--json] (it takes no --domain, --cursor or --all)");
+  }
+  await withConfig(opts.json === true || parent.json === true, false, (ctx) => toolsDomains(ctx));
+});
+program.command("tool").description("one capability Operator can use, with its whole input schema (or, for a read, its result schema)").argument("[id]").option("--schema <which>", "input (the default) or result, for a read").option("--json", "emit JSON").action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness tool <capability-id> [--schema input|result]");
+  requireCapabilityId(id);
+  requireSchemaView(opts.schema);
+  await withConfig(opts.json === true, false, (ctx) => toolShow(ctx, id, opts));
+});
+program.command("skills").description("the organization's skills assigned to Operator: identity and content checksum, never content").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => skillsList(ctx));
+});
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-75QJASTY.js");
-  await startMcpServer();
+  const { startMcpServer } = await import("./server-KVRQBVXI.js");
+  await startMcpServer(invokedAs);
 });
 var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
 keys.command("list").description("provider slugs the org has keys for and the env var each maps to \u2014 never the values").option("--json", "emit JSON").action(async (opts) => {
@@ -2078,11 +2508,11 @@ program.command("login").description("sign in via the browser (infra.one session
   async (opts) => {
     const repoLookup = findRepoConfig();
     for (const warning of repoLookup.warnings)
-      process.stderr.write(warning + "\n");
+      writeStderr(warning + "\n");
     const repoUrl = repoLookup.config?.url;
     const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
     if (url === repoUrl && opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0) {
-      process.stderr.write(
+      writeStderr(
         `harness: host ${url} comes from ${repoLookup.config?.path}
 `
       );
@@ -2098,18 +2528,27 @@ program.command("logout").description("revoke and forget the stored login").opti
 program.command("whoami").description("show the resolved host and credential source").option("--json", "emit JSON").action(async (opts) => {
   const resolved = resolveConfig();
   for (const warning of resolved.warnings)
-    process.stderr.write(warning + "\n");
+    writeStderr(warning + "\n");
   if (resolved.kind === "error") {
-    process.stderr.write(`harness: ${resolved.message}
+    writeStderr(`harness: ${resolved.message}
 `);
     return exitWith(2);
   }
   if (resolved.kind === "needs-login") {
-    process.stderr.write(loginHelp(resolved.baseUrl));
+    writeStderr(loginHelp(resolved.baseUrl));
     return exitWith(2);
   }
   const source = blankToUndefined(process.env["HARNESS_API_TOKEN"]) !== void 0 ? "environment" : "stored login";
-  await finishAuth(await whoami(resolved.config, source), opts.json === true);
+  let result;
+  try {
+    result = await whoami(resolved.config, source);
+  } catch (error) {
+    if (!(error instanceof TransportError)) throw error;
+    writeStderr(`harness: cannot reach the API: ${clean(error.message)}
+`);
+    return exitWith(3);
+  }
+  await finishAuth(result, opts.json === true);
 });
 function storedLoginUrl() {
   return readCredentials(defaultCredentialsPath())?.url;
@@ -2122,7 +2561,7 @@ async function finishAuth(result, json2) {
     process.stdout.write(json2 ? json(result.json) : result.human);
     return exitWith(0);
   }
-  process.stderr.write(`harness: ${clean(result.message)}
+  writeStderr(`harness: ${clean(result.message)}
 `);
   return exitWith(1);
 }
@@ -2134,9 +2573,10 @@ if (argv[2] === UPDATE_CHECK_COMMAND) {
 }
 try {
   const notice = updateCheck();
-  if (notice !== null) process.stderr.write(notice);
+  if (notice !== null) writeStderr(notice);
 } catch {
 }
+if (invokedAs === "operator") layoutOperatorHelp(program);
 if (argv.length <= 2) {
   program.outputHelp({ error: true });
   await exitWith(2);
@@ -2145,7 +2585,7 @@ try {
   await program.parseAsync(argv);
 } catch (error) {
   if (error instanceof UsageError) {
-    process.stderr.write(error.message + "\n");
+    writeStderr(error.message + "\n");
     await exitWith(2);
   }
   if (error instanceof CommanderError) {