@allocator-one/harness-cli 1.15.0 → 1.15.1

package/dist/{chunk-I2S2JVCQ.js → chunk-L2OWOZ4N.js}

@@ -1,4 +1,10 @@
 #!/usr/bin/env node
+import {
+  CLI_PACKAGE,
+  CLI_VERSION,
+  invokedName,
+  named
+} from "./chunk-FQWV5MIC.js";
 
 // src/core/errors.ts
 var HttpError = class extends Error {
@@ -52,14 +58,6 @@ var CommandError = class extends Error {
   }
 };
 
-// src/version.ts
-import { readFileSync } from "fs";
-var pkg = JSON.parse(
-  readFileSync(new URL("../package.json", import.meta.url), "utf8")
-);
-var CLI_VERSION = pkg.version;
-var CLI_PACKAGE = pkg.name;
-
 // src/core/expert.ts
 var EXPERT_TOKEN_PREFIX = "pxc_";
 var EXPERT_ASSIGNMENTS_PATH = "/api/v1/expert/assignments";
@@ -93,9 +91,15 @@ var DEFAULT_MESSAGES = {
   404: "Not found",
   409: "Conflict",
   422: "Validation error",
-  426: "CLI too old for this API \u2014 upgrade: npm i -g @allocator-one/harness-cli@latest",
+  426: `CLI too old for this API \u2014 upgrade: npm i -g ${CLI_PACKAGE}@latest`,
   429: "Rate limited \u2014 retry later"
 };
+var API_VERSION_HEADER = "x-harness-api-version";
+var STATS_PATH = "/api/v1/stats";
+var SESSION_PATH = "/api/v1/session";
+function isLoginCredential(token) {
+  return !token.startsWith("aone_") && !isExpertToken(token);
+}
 var Client = class {
   constructor(config) {
     this.config = config;
@@ -153,16 +157,32 @@ var Client = class {
       throw new TransportError(transportMessage(error), transportCode(error));
     }
   }
+  /**
+   * A GET that also hands back the server's API version header, so a probe
+   * that verifies a credential reports the version without a second
+   * request. Errors map as for `get`.
+   */
+  async getVersioned(path2) {
+    const response = await this.raw("GET", path2, {});
+    const apiVersion = response.headers.get(API_VERSION_HEADER);
+    return { envelope: await this.json(response), apiVersion };
+  }
   /**
    * The server's API version, for `version`'s server side. The header rides
-   * on every response — the versioning plug runs before auth — so even a
-   * 401 answers. A pxc_ credential probes the one route it reaches, so the
-   * probe is never a refusal in the server's log.
+   * on every response of a route the server has — the versioning plug runs
+   * before auth — so even a 401 answers. Each credential probes a route it
+   * reaches, so the probe is never a refusal in the server's log: a pxc_
+   * credential its assignments, a login credential of either kind (the
+   * Operator-only one reaches no tracker read) GET /api/v1/session, and an
+   * aone_ token the stats. A server older than GET /api/v1/session answers
+   * that route's 404 without the header, so the stats answer then.
    */
   async serverVersion() {
-    const path2 = isExpertToken(this.config.token) ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats";
-    const response = await this.raw("GET", path2, {});
-    return response.headers.get("x-harness-api-version") ?? "unknown";
+    const token = this.config.token;
+    const path2 = isExpertToken(token) ? EXPERT_ASSIGNMENTS_PATH : isLoginCredential(token) ? SESSION_PATH : STATS_PATH;
+    const version2 = (await this.raw("GET", path2, {})).headers.get(API_VERSION_HEADER);
+    if (version2 !== null || path2 !== SESSION_PATH) return version2 ?? "unknown";
+    return (await this.raw("GET", STATS_PATH, {})).headers.get(API_VERSION_HEADER) ?? "unknown";
   }
   // Only an explicitly configured actor is sent, and never over one the
   // caller already put in the body.
@@ -966,7 +986,7 @@ function path(record, ...keys) {
 }
 
 // src/commands/issues.ts
-import { openAsBlob, openSync, closeSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { openAsBlob, openSync, closeSync, readFileSync, statSync as statSync2 } from "fs";
 import { basename, extname } from "path";
 
 // src/core/attachments.ts
@@ -1198,7 +1218,7 @@ function requireReadyClaimArgs(opts) {
 async function claimNext(ctx, opts) {
   requireReadyClaimArgs(opts);
   const team = requiredTeam(ctx, opts.team);
-  const check = `check \`harness list --team ${team} --assignee me --status in_progress\``;
+  const check = `check \`${invokedName()} list --team ${team} --assignee me --status in_progress\``;
   const unreadable = (why) => new CommandError(`The claim-next response ${why}, so an issue may have been claimed \u2014 ${check}.`);
   let body;
   try {
@@ -1356,14 +1376,14 @@ async function prime(ctx) {
   const statsBody = await ctx.client.get("/api/v1/stats");
   const ready2 = markAgentSteps(await mostImportantReady(ctx));
   const json2 = { stats: statsBody.data, ready: ready2 };
-  const human = "# Harness workflow context\n\n" + stats(statsBody.data) + "\nReady to work:\n" + issuesTable(ready2, { markAgentSteps: true }) + `
+  const human = "# Harness workflow context\n\n" + stats(statsBody.data) + "\nReady to work:\n" + issuesTable(ready2, { markAgentSteps: true }) + named(`
 Workflow: harness ready \u2192 harness update <id> --claim \u2192 work \u2192
 harness close <id> --reason "Implemented in <commit-hash>" (response
 lists newly unblocked issues \u2014 surface them).
 Create tracked work BEFORE coding: harness create --title "\u2026" --type task.
 Dependencies: harness dep add <issue> <blocker> (blocker blocks issue).
 Before reporting done: close the issues you finished.
-`;
+`);
   return { json: json2, human };
 }
 async function mostImportantReady(ctx) {
@@ -1381,7 +1401,7 @@ async function version(config) {
   } else {
     server = await new Client(config).serverVersion().catch(() => "unreachable");
   }
-  return { json: { cli: CLI_VERSION, server }, human: `harness ${CLI_VERSION} (server API ${server})
+  return { json: { cli: CLI_VERSION, server }, human: `${invokedName()} ${CLI_VERSION} (server API ${server})
 ` };
 }
 async function create(ctx, opts) {
@@ -1496,8 +1516,8 @@ ${opts.appendNotes}`;
 var CLAIM_REFUSAL_HINTS = {
   // The edit holds a released step, so the plan needs releasing again before
   // the step is claimable.
-  agent_step: () => "Operator runs it for its plan; to do it yourself, set its executor to none (harness plan edit <plan-id>) and release the plan again",
-  waiting_on_condition: (identifier) => `harness show ${identifier} lists what it waits on; tick a gate with harness gate satisfy ${identifier} <gate>`
+  agent_step: () => `Operator runs it for its plan; to do it yourself, set its executor to none (${invokedName()} plan edit <plan-id>) and release the plan again`,
+  waiting_on_condition: (identifier) => `${invokedName()} show ${identifier} lists what it waits on; tick a gate with ${invokedName()} gate satisfy ${identifier} <gate>`
 };
 function explainClaimRefusal(error, identifier) {
   if (!(error instanceof HttpError) || error.status !== 409) return error;
@@ -1604,9 +1624,9 @@ async function archive(ctx, identifiers, opts) {
 }
 async function comments(ctx, identifier) {
   requireIdentifiers([identifier]);
-  const body = await ctx.client.get(`/api/v1/issues/${identifier}/comments`);
-  if (body.data.length === 0) return { json: body.data, human: "No comments.\n" };
-  const human = body.data.map((comment2) => {
+  const records5 = await completeCommentThread(ctx, identifier);
+  if (records5.length === 0) return { json: records5, human: "No comments.\n" };
+  const human = records5.map((comment2) => {
     const author = clean((comment2["author"] ?? {})["name"] ?? "unknown");
     const id = clean(comment2["id"] ?? "unknown id");
     const text = cleanMultiline(str2(comment2["body"])).split("\n").map((line) => "  " + line).join("\n");
@@ -1614,7 +1634,35 @@ async function comments(ctx, identifier) {
 ${text}
 `;
   }).join("\n");
-  return { json: body.data, human };
+  return { json: records5, human };
+}
+async function completeCommentThread(ctx, identifier) {
+  const pages = [];
+  const seen = /* @__PURE__ */ new Set();
+  let before;
+  for (; ; ) {
+    const page = await ctx.client.get(`/api/v1/issues/${identifier}/comments`, {
+      limit: 200,
+      before
+    });
+    if (!Array.isArray(page.data) || typeof page.meta?.has_more !== "boolean") {
+      throw new CommandError("Invalid comment pagination: expected a comment array and boolean meta.has_more; completeness unknown.");
+    }
+    const records5 = [];
+    for (const record of page.data) {
+      if (record === null || typeof record !== "object" || Array.isArray(record) || typeof record.id !== "string" || record.id.trim() === "" || seen.has(record.id)) {
+        throw new CommandError("Invalid comment pagination: missing or repeated comment id; completeness unknown.");
+      }
+      seen.add(record.id);
+      records5.push(record);
+    }
+    pages.push(records5);
+    if (!page.meta.has_more) return pages.reverse().flat();
+    if (records5.length === 0) {
+      throw new CommandError("Invalid comment pagination: has_more on an empty page; completeness unknown.");
+    }
+    before = records5[0]["id"];
+  }
 }
 async function dep(ctx, verb, issue, blocker) {
   requireIdentifiers([issue, blocker]);
@@ -1764,7 +1812,7 @@ async function attachFile(ctx, path2) {
 }
 async function uploadAttachment(ctx, path2, maxBytes) {
   attachableFile(path2, maxBytes);
-  const file = maxBytes === MAX_VIDEO_BYTES ? new File([await openAsBlob(path2)], basename(path2)) : new File([readFileSync2(path2)], basename(path2));
+  const file = maxBytes === MAX_VIDEO_BYTES ? new File([await openAsBlob(path2)], basename(path2)) : new File([readFileSync(path2)], basename(path2));
   requireAttachmentSize(path2, file.size, maxBytes);
   const form = new FormData();
   form.set("file", file);
@@ -1871,13 +1919,13 @@ async function prepareApplicableLabelIds(ctx, teamId, names) {
 }
 function applicableLabel(labels, input, teamId) {
   const normalized = normalizeLabelName(input);
-  const named = labels.filter((label) => normalizeLabelName(label["name"]) === normalized);
-  const teamMatches = named.filter((label) => label["team_id"] === teamId);
+  const named2 = labels.filter((label) => normalizeLabelName(label["name"]) === normalized);
+  const teamMatches = named2.filter((label) => label["team_id"] === teamId);
   if (teamMatches.length > 1) {
     throw new CommandError(`more than one team label matches "${input}"; use a label id`);
   }
   if (teamMatches.length === 1) return teamMatches[0];
-  const workspaceMatches = named.filter(
+  const workspaceMatches = named2.filter(
     (label) => label["team_id"] === null || label["team_id"] === void 0
   );
   if (workspaceMatches.length > 1) {
@@ -2003,8 +2051,8 @@ function listParams(ctx, opts) {
 }
 function optionalPriority(value) {
   if (value === void 0) return null;
-  const named = Object.hasOwn(PRIORITY_NAMES, value) ? PRIORITY_NAMES[value] : void 0;
-  if (named !== void 0) return named;
+  const named2 = Object.hasOwn(PRIORITY_NAMES, value) ? PRIORITY_NAMES[value] : void 0;
+  if (named2 !== void 0) return named2;
   if (/^\d+$/.test(value)) {
     throw new UsageError(
       `Bare numeric priorities are refused: bd and harness disagree on what
@@ -2518,7 +2566,7 @@ var APPROVAL_NOTE = "Write and send capabilities, and any proposal, need a perso
 var REFUSALS = {
   operator_disabled: "nothing here works until it is switched back on",
   operator_not_permitted: "this account has no admin or member role in the organization the credential is bound to",
-  actor_required: "this credential acts as no person: sign in with `harness login`, or use an API token minted for a user",
+  actor_required: `this credential acts as no person: sign in with \`${invokedName()} login\`, or use an API token minted for a user`,
   run_bound_credential: "a run-bound credential can't read Operator's catalog",
   forbidden: "Operator needs the operator:read scope (aone_ API tokens must be minted with it) and an admin or member role"
 };
@@ -2638,7 +2686,7 @@ function requireCapabilityId(id) {
     throw new UsageError(`not a capability id: ${clean(id)} (e.g. crm.party.search)`);
   }
   if (id === "domains") {
-    throw new UsageError("domains is not a capability id \u2014 `harness tools domains` lists the domains");
+    throw new UsageError(`domains is not a capability id \u2014 \`${invokedName()} tools domains\` lists the domains`);
   }
 }
 function requireSearchQuery(query) {
@@ -2995,9 +3043,9 @@ function jobPeople(job) {
   const participants = records3(field2(job, "people", "participants"));
   const owner = isRecord2(job["owner"]) ? job["owner"] : null;
   const names = /* @__PURE__ */ new Map();
-  for (const named of owner === null ? participants : [...participants, owner]) {
-    if (typeof named["user_id"] === "string" && typeof named["name"] === "string" && named["name"] !== "") {
-      if (!names.has(named["user_id"])) names.set(named["user_id"], named["name"]);
+  for (const named2 of owner === null ? participants : [...participants, owner]) {
+    if (typeof named2["user_id"] === "string" && typeof named2["name"] === "string" && named2["name"] !== "") {
+      if (!names.has(named2["user_id"])) names.set(named2["user_id"], named2["name"]);
     }
   }
   const person = (userId) => typeof userId === "string" && userId !== "" ? { user_id: userId, name: names.get(userId) ?? null } : null;
@@ -3090,7 +3138,8 @@ async function jobWatch(ctx, id, opts) {
   }
 }
 function resumeLine(id, after) {
-  return `harness: stopped watching job ${id}; resume with: harness watch ${id} --after ${after}
+  const name = invokedName();
+  return `${name}: stopped watching job ${id}; resume with: ${name} watch ${id} --after ${after}
 `;
 }
 function watchStopSignal(stdout = process.stdout, signals = process) {
@@ -3179,9 +3228,9 @@ async function eventsPage(ctx, id, after) {
 var REFUSAL_HINTS = {
   operator_disabled: "nothing can be read until Operator is switched back on for this organization",
   operator_not_permitted: "only the organization's admins and members use Operator; guests and people outside it cannot",
-  actor_required: "the credential acts as no person: sign in with `harness login`, or use an API token a person created",
-  forbidden: "the credential lacks the operator:read scope (`harness login` carries it; an aone_ token must be created with it, bound to this organization), or you are a guest or outside the organization",
-  run_bound_credential: "a run-bound credential cannot read Operator jobs; sign in with `harness login`"
+  actor_required: `the credential acts as no person: sign in with \`${invokedName()} login\`, or use an API token a person created`,
+  forbidden: `the credential lacks the operator:read scope (\`${invokedName()} login\` carries it; an aone_ token must be created with it, bound to this organization), or you are a guest or outside the organization`,
+  run_bound_credential: `a run-bound credential cannot read Operator jobs; sign in with \`${invokedName()} login\``
 };
 function missingJob(id) {
   return `no Operator job ${id} you can see: it does not exist, is in another organization, or is not shared with you (or this Harness server has no Operator API yet)`;
@@ -3567,10 +3616,10 @@ async function sendOnce(ctx, path2, body, write2) {
     throw error;
   }
 }
-function explainRefusal(error, notFound2, hints) {
+function explainRefusal(error, notFound2, hints2) {
   if (!(error instanceof HttpError) || error instanceof UpgradeRequiredError) return error;
   const code = typeof error.body["error"] === "string" ? error.body["error"] : "";
-  const own = Object.hasOwn(hints, code) ? hints[code] : void 0;
+  const own = Object.hasOwn(hints2, code) ? hints2[code] : void 0;
   let hint;
   if (error.status >= 500) hint = own;
   else if (error.status === 404) hint = notFound2;
@@ -3578,10 +3627,132 @@ function explainRefusal(error, notFound2, hints) {
   else if (error.status === 403 && Object.hasOwn(ACCESS_HINTS, code)) hint = ACCESS_HINTS[code];
   else if (error.status === 400 && code === "bad_request") hint = BAD_REQUEST_HINT;
   if (hint === void 0) return error;
-  const message = error.status >= 500 && typeof error.body["message"] === "string" ? error.body["message"] : error.message;
+  const message = error.status < 500 ? error.message : typeof error.body["message"] === "string" ? error.body["message"] : own !== void 0 ? `The server answered ${error.status}` : error.message;
   return new HttpError(error.status, `${message} \u2014 ${hint}`, error.body, error.retryAfter);
 }
 
+// src/commands/operator-run.ts
+var OUTCOME_MAX_CHARACTERS = 1e4;
+var BUDGET_MAX_DOLLARS = 1e6;
+var SKILL = /^\/?[a-z0-9]+(-[a-z0-9]+)*$/;
+var SKILL_MAX_CHARACTERS = 65;
+var BUDGET = /^\d+(\.\d{1,2})?$/;
+function prepareRun(outcome, opts = {}, surface = CLI_SURFACE) {
+  const trimmed = outcome.trim();
+  if (trimmed === "") throw new UsageError(`the outcome is empty \u2014 say what the job should achieve${surface.outcomeHint}`);
+  const length = graphemeLength(trimmed);
+  if (length > OUTCOME_MAX_CHARACTERS) {
+    throw new UsageError(
+      `the outcome is ${length} characters once trimmed; a job takes at most ${OUTCOME_MAX_CHARACTERS}`
+    );
+  }
+  const body = { outcome: trimmed };
+  if (opts.budget !== void 0) {
+    const budget = opts.budget.trim();
+    const amount = BUDGET.test(budget) ? Number(budget) : NaN;
+    if (!(amount > 0) || amount > BUDGET_MAX_DOLLARS) {
+      throw new UsageError(
+        `${surface.budget} takes a positive amount in US dollars with at most two decimals, up to ${BUDGET_MAX_DOLLARS}`
+      );
+    }
+    body["budget"] = amount;
+  }
+  if (opts.skill !== void 0) {
+    const skill = opts.skill.trim();
+    if (skill.length > SKILL_MAX_CHARACTERS || !SKILL.test(skill)) {
+      throw new UsageError(
+        `${surface.skill} takes a skill's invocation name, like /summarize-lps (${surface.skills} lists them)`
+      );
+    }
+    body["skill"] = skill;
+  }
+  return { body };
+}
+var CLI_SURFACE = {
+  budget: "--budget",
+  skill: "--skill",
+  outcomeHint: ': run "<outcome>"',
+  skills: "`skills`",
+  look: "`jobs --mine` for the new job",
+  again: "run again"
+};
+var MCP_SURFACE = {
+  budget: "budget",
+  skill: "skill",
+  outcomeHint: "",
+  skills: "`skills_list`",
+  look: "`jobs_list` with mine for the new job",
+  again: "call again"
+};
+async function startRun(ctx, request, surface = CLI_SURFACE) {
+  const write2 = { mayHave: "a job may have been started", check: surface.look };
+  let data;
+  try {
+    data = (await sendOnce(ctx, "/api/v1/operator/jobs", request.body, write2)).data;
+  } catch (error) {
+    throw explainRefusal(error, "this Harness server has no Operator API for starting jobs yet", hints(error, surface));
+  }
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    throw outcomeUnknown("the answer named no job", write2);
+  }
+  const record = data;
+  const jobId = record["job_id"];
+  if (typeof jobId !== "string" || jobId === "") throw outcomeUnknown("the answer named no job", write2);
+  const text = (value) => typeof value === "string" ? value : "";
+  return {
+    job_id: jobId,
+    state: text(record["state"]),
+    workbench_url: text(record["workbench_url"]),
+    approval_url: text(record["approval_url"]) === "" ? null : text(record["approval_url"])
+  };
+}
+function hints(error, surface) {
+  const retryAfter = error instanceof HttpError ? error.retryAfter : null;
+  return {
+    budget_not_permitted: `nothing was started: only the organization's admins, who manage its Operator budget, can pass ${surface.budget} \u2014 ${surface.again} without it`,
+    budget_exceeded: `nothing was started: the organization's monthly Operator budget has less than ${surface.budget} left this month \u2014 pass a smaller budget, or ask an admin`,
+    concurrent_change: `nothing was started: Operator or your access changed while the job started \u2014 check that you can still use Operator, then ${surface.again}`,
+    invalid_outcome: `nothing was started: pass the outcome as text of 1 to ${OUTCOME_MAX_CHARACTERS} characters once trimmed, without control characters`,
+    invalid_budget: `nothing was started: ${surface.budget} takes a positive amount in US dollars with at most two decimals, up to ${BUDGET_MAX_DOLLARS}`,
+    unknown_skill: `nothing was started: no Operator skill of that name that you may run in the organization (${surface.skills} lists them)`,
+    rate_limited: "nothing was started: you can start 30 jobs an hour this way" + (retryAfter === null ? "" : `; try again in ${clean(retryAfter)} s`),
+    service_unavailable: "nothing was started; try again later"
+  };
+}
+function startedText(job) {
+  return `Started Operator job ${clean(job.job_id)}.
+` + labelled([
+    ["State", clean(job.state) || null],
+    ["Workbench", clean(job.workbench_url) || null],
+    ["Approve at", job.approval_url === null ? null : clean(job.approval_url)]
+  ]) + (job.approval_url === null ? "" : "\nApproving happens in the app; the CLI cannot approve.\n");
+}
+async function run(ctx, request, opts = {}) {
+  const job = await startRun(ctx, request);
+  if (opts.watch !== true) return { json: job, human: startedText(job) };
+  const json2 = opts.json === true;
+  if (!json2) opts.onLine?.(startedText(job) + "\n");
+  let watched;
+  try {
+    watched = await jobWatch(ctx, job.job_id, {
+      throughWaits: true,
+      collectEvents: json2,
+      onLine: json2 ? void 0 : opts.onLine,
+      signal: opts.signal,
+      sleep: opts.sleep
+    });
+  } catch (error) {
+    const follow = ` \u2014 the job was started: follow it with \`watch ${job.job_id}\``;
+    if (error instanceof HttpError) {
+      throw new HttpError(error.status, `${error.message}${follow}`, error.body, error.retryAfter);
+    }
+    if (error instanceof TransportError) throw new TransportError(`${error.message}${follow}`, error.code);
+    if (error instanceof CommandError) throw new CommandError(`${error.message}${follow}`);
+    throw error;
+  }
+  return { ...watched, json: { ...job, watch: watched.json } };
+}
+
 // src/commands/operator-continue.ts
 async function jobContinue(ctx, id) {
   requireJobId(id);
@@ -3614,7 +3785,7 @@ function refusals(id) {
 }
 
 // src/core/textinput.ts
-import { readFileSync as readFileSync3, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync2, statSync as statSync3 } from "fs";
 import { isatty } from "tty";
 var STDIN_PATH = "-";
 var MAX_TEXT_BYTES = 1e6;
@@ -3672,7 +3843,7 @@ function readTextFile(path2, option, limit = TEXT_LIMIT) {
   if (path2 === STDIN_PATH) {
     let piped;
     try {
-      piped = readFileSync3(0);
+      piped = readFileSync2(0);
     } catch (error) {
       throw new UsageError(`${option} -: cannot read stdin (${describe(error)})`);
     }
@@ -3684,7 +3855,7 @@ function readTextFile(path2, option, limit = TEXT_LIMIT) {
   const flag = `${option} ${path2}`;
   let bytes;
   try {
-    bytes = readFileSync3(path2);
+    bytes = readFileSync2(path2);
   } catch (error) {
     throw new UsageError(`${flag}: ${describe(error)}`);
   }
@@ -3882,14 +4053,14 @@ function requireProcedureName(name) {
 }
 async function procedureSave(ctx, jobId, name) {
   requireJobId(jobId);
-  const named = requireProcedureName(name);
+  const named2 = requireProcedureName(name);
   const write2 = {
     mayHave: "a procedure may have been saved",
     check: `the job's procedures with \`job ${jobId}\``
   };
   let data;
   try {
-    data = (await sendOnce(ctx, `/api/v1/operator/jobs/${jobId}/procedures`, { name: named }, write2)).data;
+    data = (await sendOnce(ctx, `/api/v1/operator/jobs/${jobId}/procedures`, { name: named2 }, write2)).data;
   } catch (error) {
     throw explainRefusal(error, missingJob(jobId), {
       owner_required: "only the job's owner can save it as a procedure; ask them to save it",
@@ -4160,7 +4331,7 @@ async function planCreate(ctx, plan, opts) {
     human: `Created plan ${clean(id)} (${clean(created["status"]) || "held"})
 
 ` + planDetail(created) + `
-Nothing runs until it is released: harness plan release ${clean(id)}
+Nothing runs until it is released: ${invokedName()} plan release ${clean(id)}
 `
   };
 }
@@ -4179,7 +4350,7 @@ async function planEdit(ctx, id, edits) {
     human: `Updated plan ${clean(id)}
 
 ` + planDetail(plan) + (held ? `
-Release it again to run the held steps: harness plan release ${clean(id)}
+Release it again to run the held steps: ${invokedName()} plan release ${clean(id)}
 ` : "")
   };
 }
@@ -4295,8 +4466,8 @@ async function explainNotGateOwner(ctx, error, gate, issue, satisfied) {
   }
   const owner = isRecord5(currentOwner) ? ownerText(currentOwner) : "";
   const subject = `its owner${owner === "" ? "" : `, ${owner},`}`;
-  const named = `gate "${clean((current ?? gate)["label"])}" on ${issue}`;
-  const message = satisfied ? `Cannot satisfy ${named}: only ${subject} can tick it` : `Cannot un-satisfy ${named}: only ${subject} or Harness staff can untick it`;
+  const named2 = `gate "${clean((current ?? gate)["label"])}" on ${issue}`;
+  const message = satisfied ? `Cannot satisfy ${named2}: only ${subject} can tick it` : `Cannot un-satisfy ${named2}: only ${subject} or Harness staff can untick it`;
   return new HttpError(error.status, message, error.body, error.retryAfter);
 }
 var gateLabel = (condition) => str7(condition["label"]).trim();
@@ -4373,7 +4544,7 @@ function isRecord6(value) {
 }
 
 // src/core/credentials.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir } from "os";
 import { dirname as dirname2, isAbsolute, join as join2 } from "path";
 function defaultCredentialsPath(env = process.env) {
@@ -4383,7 +4554,7 @@ function defaultCredentialsPath(env = process.env) {
 }
 function readCredentials(path2) {
   try {
-    const parsed = JSON.parse(readFileSync4(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync3(path2, "utf8"));
     if (typeof parsed === "object" && parsed !== null) {
       const { url, token } = parsed;
       if (typeof url === "string" && typeof token === "string") return { url, token };
@@ -4410,7 +4581,7 @@ function deleteCredentials(path2) {
 }
 
 // src/core/repo-config.ts
-import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, parse } from "path";
 var CONFIG_RELATIVE_PATH = join3(".harness-cli", "config.json");
@@ -4429,7 +4600,7 @@ function findRepoConfig(startDir = process.cwd()) {
 function readRepoConfig(path2) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(path2, "utf8"));
+    parsed = JSON.parse(readFileSync4(path2, "utf8"));
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     return { config: null, warnings: [`harness: ignoring malformed ${path2} (${detail})`] };
@@ -4458,7 +4629,7 @@ function trustedHostsPath(env = process.env) {
 }
 function readTrustedHosts(env) {
   try {
-    const parsed = JSON.parse(readFileSync5(trustedHostsPath(env), "utf8"));
+    const parsed = JSON.parse(readFileSync4(trustedHostsPath(env), "utf8"));
     if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed["hosts"])) {
       return parsed["hosts"].filter(
         (host) => typeof host === "string"
@@ -4590,13 +4761,13 @@ function validateBaseUrl(baseUrl) {
   }
   return { ok: false, message: `HARNESS_API_URL must be an http(s) URL with a host, got: ${baseUrl}` };
 }
-function loginHelp(baseUrl) {
+function loginHelp(baseUrl, name = invokedName()) {
   return `Not signed in to ${baseUrl}.
 
 Interactively, in a terminal (not from inside an agent \u2014 the browser
 tab needs someone to see it):
 
-    harness login
+    ${name} login
 
 For agents and CI, mint an API token (admin \u2192 API tokens) with the
 harness:read scope \u2014 plus harness:write only where the workflow
@@ -4605,7 +4776,7 @@ creates or closes \u2014 set an expiry, and export it:
     export HARNESS_API_TOKEN=aone_...
 
 An outside expert uses the pxc_ credential minted in their expert view:
-export it the same way, or paste it into \`harness login --no-browser\`.
+export it the same way, or paste it into \`${name} login --no-browser\`.
 `;
 }
 function blankToNull(value) {
@@ -4620,12 +4791,12 @@ export {
   UsageError,
   LocalError,
   CommandError,
-  CLI_VERSION,
-  CLI_PACKAGE,
   EXPERT_ASSIGNMENTS_PATH,
   isExpertToken,
   EXPERT_LAPSED,
   explainExpertRefusal,
+  SESSION_PATH,
+  isLoginCredential,
   Client,
   clean,
   json,
@@ -4719,6 +4890,12 @@ export {
   jobShow,
   jobWatch,
   watchStopSignal,
+  OUTCOME_MAX_CHARACTERS,
+  BUDGET_MAX_DOLLARS,
+  prepareRun,
+  MCP_SURFACE,
+  startRun,
+  run,
   jobContinue,
   resolveTextSources,
   STEER_MAX_CHARACTERS,