@allocator-one/harness-cli 1.15.0 → 1.15.1

package/dist/cli.js

@@ -1,8 +1,6 @@
 #!/usr/bin/env node
 import {
   ACTIVITY_MAX_LIMIT,
-  CLI_PACKAGE,
-  CLI_VERSION,
   Client,
   CommandError,
   DEFAULT_BASE_URL,
@@ -18,6 +16,7 @@ import {
   LocalError,
   RELATION_CREATE_TYPES,
   RELATION_UPDATE_TYPES,
+  SESSION_PATH,
   STEER_MAX_CHARACTERS,
   TransportError,
   UpgradeRequiredError,
@@ -50,6 +49,7 @@ import {
   instructionFrom,
   isExpertToken,
   isHostTrusted,
+  isLoginCredential,
   jobCancel,
   jobContinue,
   jobPause,
@@ -79,6 +79,7 @@ import {
   planRelease,
   planShow,
   prepareProcedureRun,
+  prepareRun,
   prime,
   procedureSave,
   procedureShow,
@@ -110,6 +111,7 @@ import {
   resolveCacheHome,
   resolveConfig,
   resolveTextSources,
+  run,
   search,
   show,
   skillsList,
@@ -137,7 +139,14 @@ import {
   watchStopSignal,
   workflowStates,
   writeCredentials
-} from "./chunk-I2S2JVCQ.js";
+} from "./chunk-L2OWOZ4N.js";
+import {
+  CLI_VERSION,
+  OPERATOR_PACKAGE,
+  invokedName,
+  layoutOperatorHelp,
+  named
+} from "./chunk-FQWV5MIC.js";
 
 // src/cli.ts
 import { createInterface as createInterface2 } from "readline";
@@ -267,8 +276,10 @@ async function exec(ctx, opts) {
     const missing = unstoredSlugs(requested, stored);
     if (missing.length > 0) {
       process.stderr.write(
-        `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
+        named(
+          `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
 `
+        )
       );
     }
   }
@@ -338,9 +349,10 @@ var RESPONSE_FLUSH_TIMEOUT_MS = 2e3;
 var MAX_PAGE_RESPONSES = 4;
 var loginPageImport;
 function loadLoginPage() {
-  loginPageImport ??= import("./login-page-UVUKFFTT.js");
+  loginPageImport ??= import("./login-page-KGEJFFXR.js");
   return loginPageImport;
 }
+var NO_SESSION = { kind: null, expires_at: null, scopes: null, user: null, org: null };
 function generateState() {
   return randomBytes(24).toString("base64url");
 }
@@ -439,7 +451,7 @@ async function loopbackLogin(baseUrl, options) {
         );
         return token;
       }
-      const result = await verifyAndStore(baseUrl, token.token, options);
+      const result = await verifyAndStore(baseUrl, token.token, options, { minted: true, kind: token.kind });
       if (result.ok) {
         await callback.respond(200, "You can close this browser and return to the terminal.", "success");
       } else {
@@ -492,7 +504,7 @@ function awaitCallback(server, state2, timeoutMs) {
       if (phase !== "waiting") return;
       const timeoutResponse = {
         status: 410,
-        message: "This login attempt has ended \u2014 run harness login again if needed.",
+        message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
         pageState: "error"
       };
       phase = "terminal";
@@ -564,7 +576,7 @@ function awaitCallback(server, state2, timeoutMs) {
         }
         const result = finalResponse ?? {
           status: 410,
-          message: "This login attempt has ended \u2014 run harness login again if needed.",
+          message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
           pageState: "error"
         };
         void trackResponse(respondWithPage(result.status, result.message, result.pageState));
@@ -696,7 +708,8 @@ async function exchangeCode(baseUrl, code, verifier, options) {
   try {
     const body = await bareClient(baseUrl, "", options).post("/api/v1/cli/token-exchange", { code, code_verifier: verifier });
     const token = body.data?.token;
-    if (typeof token === "string" && token !== "") return { ok: true, token };
+    const kind = typeof body.data?.kind === "string" ? body.data.kind : null;
+    if (typeof token === "string" && token !== "") return { ok: true, token, kind };
     return {
       ok: false,
       message: "the login-code exchange returned no token \u2014 aborting"
@@ -725,20 +738,28 @@ async function manualLogin(baseUrl, options) {
   );
   const token = (await prompt()).trim();
   if (token === "") return { ok: false, message: "no token entered" };
-  return verifyAndStore(baseUrl, token, options);
+  return verifyAndStore(baseUrl, token, options, { minted: false, kind: null });
 }
-async function verifyAndStore(baseUrl, token, options) {
+async function verifyAndStore(baseUrl, token, options, received) {
   const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
   const client = bareClient(baseUrl, token, options);
   const expert = isExpertToken(token);
+  let kind = received.kind;
   try {
-    await client.get(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/teams");
+    if (expert) {
+      await client.get(EXPERT_ASSIGNMENTS_PATH);
+    } else {
+      const described = isLoginCredential(token) ? await describeSession(client) : null;
+      if (described === null) await client.get("/api/v1/teams");
+      else kind = described.session.kind ?? kind;
+    }
   } catch (error) {
     if (error instanceof HttpError) {
       const lapsed = expert && error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : "";
+      const revoked = received.minted && await revokeSession(client, token);
       return {
         ok: false,
-        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored${lapsed}`
+        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored${revoked ? ", and the token was revoked" : ""}${lapsed}`
       };
     }
     if (error instanceof TransportError) {
@@ -754,11 +775,11 @@ async function verifyAndStore(baseUrl, token, options) {
   try {
     writeCredentials(path, baseUrl, token);
   } catch (error) {
-    await revokeSession(client, token);
+    if (received.minted) await revokeSession(client, token);
     const detail = error instanceof Error ? error.message : String(error);
     return {
       ok: false,
-      message: `could not store credentials at ${path}: ${detail}` + (expert ? " (the pxc_ credential is still valid: revoke it in your expert view)" : "")
+      message: `could not store credentials at ${path}: ${detail}` + (expert ? " (the pxc_ credential is still valid: revoke it in your expert view)" : received.minted ? "" : " (the pasted token was not revoked and stays valid)")
     };
   }
   let supersededNote = "";
@@ -768,12 +789,40 @@ async function verifyAndStore(baseUrl, token, options) {
       supersededNote = "The pxc_ credential stored before stays valid until it expires: revoke it in your expert view.\n";
     }
   }
+  const name = invokedName();
   return {
     ok: true,
-    json: { url: baseUrl, credentials: path },
-    human: (expert ? `Stored an outside expert's pxc_ credential for ${baseUrl} at ${path} (it lasts at most 30 days; revoke it in your expert view \u2014 harness logout only forgets it). Commands now act as the expert: only assignments, conditions and gate work until you log in again.
-` : `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; harness logout revokes it).
-`) + supersededNote
+    json: { url: baseUrl, credentials: path, kind },
+    human: (expert ? `Stored an outside expert's pxc_ credential for ${baseUrl} at ${path} (it lasts at most 30 days; revoke it in your expert view \u2014 ${name} logout only forgets it). Commands now act as the expert: only assignments, conditions and gate work until you log in again.
+` : `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; ${name} logout revokes it).
+`) + kindNote(kind) + supersededNote
+  };
+}
+function kindNote(kind) {
+  if (kind === "operator-cli") {
+    return "This credential is Operator-only (operator-cli): Operator commands work; issue, plan and gate commands are refused.\n";
+  }
+  if (kind === "harness-cli") return "This credential has full access (harness-cli).\n";
+  return "";
+}
+async function describeSession(client) {
+  try {
+    const { envelope, apiVersion } = await client.getVersioned(SESSION_PATH);
+    return { session: sessionOf(envelope.data), apiVersion };
+  } catch (error) {
+    if (error instanceof HttpError && (error.status === 404 || error.status === 405)) return null;
+    throw error;
+  }
+}
+function sessionOf(data) {
+  if (!isRecord2(data)) return NO_SESSION;
+  const text = (value) => typeof value === "string" ? value : null;
+  return {
+    kind: text(data["kind"]),
+    expires_at: text(data["expires_at"]),
+    scopes: Array.isArray(data["scopes"]) ? data["scopes"].filter((scope) => typeof scope === "string") : null,
+    user: isRecord2(data["user"]) ? data["user"] : null,
+    org: isRecord2(data["org"]) ? data["org"] : null
   };
 }
 async function revokeSession(client, token) {
@@ -814,8 +863,18 @@ async function whoami(config, credentialSource) {
   const client = new Client(config);
   const expert = isExpertToken(config.token);
   let probe;
+  let session = null;
+  let serverVersion;
   try {
-    probe = (await client.get(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats")).data;
+    const described2 = isLoginCredential(config.token) ? await describeSession(client) : null;
+    if (described2 !== null) {
+      session = described2.session;
+      serverVersion = described2.apiVersion;
+    } else {
+      const answered = await client.getVersioned(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats");
+      probe = answered.envelope.data;
+      serverVersion = answered.apiVersion;
+    }
   } catch (error) {
     if (error instanceof HttpError) {
       return {
@@ -835,7 +894,7 @@ async function whoami(config, credentialSource) {
       };
     }
   }
-  const serverVersion = await client.serverVersion().catch(() => "unknown");
+  serverVersion ??= "unknown";
   const hostSourceLabels = {
     env: "HARNESS_API_URL",
     "repo-config": ".harness-cli/config.json",
@@ -846,6 +905,7 @@ async function whoami(config, credentialSource) {
   const expertLines = seat === null ? "" : `Expert:      ${expertSummary(seat)}
 Reaches:     its own assignments and the gates it owns on them (assignments, conditions, gate)
 `;
+  const described = session ?? NO_SESSION;
   return {
     ok: true,
     json: {
@@ -854,14 +914,48 @@ Reaches:     its own assignments and the gates it owns on them (assignments, con
       verified: true,
       server_version: serverVersion,
       host_source: config.hostSource,
+      kind: described.kind,
+      expires_at: described.expires_at,
+      scopes: described.scopes,
+      user: described.user,
+      org: described.org,
       expert: seat
     },
     human: `Host:        ${config.baseUrl}${via}
-Credential:  ${credentialSource}${seat === null ? "" : ", an outside expert's pxc_ credential"}
-` + expertLines + `Verified:    ok (server API ${serverVersion})
+Credential:  ${credentialSource}${seat === null ? "" : ", an outside expert's pxc_ credential"}${kindLabel(described.kind)}
+` + sessionLines(described) + expertLines + `Verified:    ok (server API ${serverVersion})
 `
   };
 }
+function kindLabel(kind) {
+  if (kind === null) return "";
+  if (kind === "harness-cli") return ", harness-cli (full access)";
+  if (kind === "operator-cli") return ", operator-cli (Operator only)";
+  return `, ${clean(kind)}`;
+}
+function sessionLines(session) {
+  let lines = "";
+  const user2 = session.user;
+  if (user2 !== null) {
+    const name = clean(user2["name"]);
+    const email = clean(user2["email"]);
+    lines += `User:        ${name === "" ? email : email === "" ? name : `${name} <${email}>`}
+`;
+  }
+  const org = session.org;
+  if (org !== null) {
+    const name = clean(org["name"]);
+    const slug = clean(org["slug"]);
+    lines += `Org:         ${slug === "" || slug === name ? name : `${name} (${slug})`}
+`;
+  }
+  if (session.expires_at !== null) lines += `Expires:     ${clean(session.expires_at)}
+`;
+  if (session.kind === "operator-cli") {
+    lines += "Reaches:     Operator commands only; issue, plan and gate commands are refused\n";
+  }
+  return lines;
+}
 function expertSeat(data) {
   if (!isRecord2(data) || !isRecord2(data["expert"])) return null;
   const plan2 = isRecord2(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
@@ -883,7 +977,7 @@ function bareClient(baseUrl, token, options) {
   return new Client(config);
 }
 function defaultNotify(line) {
-  process.stderr.write(line + "\n");
+  process.stderr.write(named(line + "\n"));
 }
 function defaultPrompt() {
   const readline = createInterface({
@@ -914,57 +1008,6 @@ function guardBrokenPipes(streams = [process.stdout, process.stderr]) {
   }
 }
 
-// src/invocation.ts
-import { basename } from "path";
-var OPERATOR_PACKAGE = "@allocator-one/operator";
-function invokedName(argv1 = process.argv[1], packageName = CLI_PACKAGE) {
-  const typed = basename(argv1 ?? "").replace(/\.[cm]?js$/i, "").toLowerCase();
-  if (typed === "operator" || typed === "harness") return typed;
-  return packageName === OPERATOR_PACKAGE ? "operator" : "harness";
-}
-var OPERATOR_COMMANDS = [
-  "run",
-  "jobs",
-  "job",
-  "watch",
-  "steer",
-  "cancel",
-  "pause",
-  "continue",
-  "procedure",
-  "plan",
-  "gate",
-  "conditions",
-  "assignments",
-  "tools",
-  "tool",
-  "skills",
-  "mcp"
-];
-var GENERAL_COMMANDS = [
-  "login",
-  "logout",
-  "whoami",
-  "version",
-  "keys"
-];
-var OPERATOR_HEADING = "Operator:";
-var ISSUES_HEADING = "Issues:";
-var GENERAL_HEADING = "General:";
-function layoutOperatorHelp(program2) {
-  const rank = (name) => {
-    const operator = OPERATOR_COMMANDS.indexOf(name);
-    if (operator !== -1) return operator;
-    return GENERAL_COMMANDS.includes(name) ? 2 * OPERATOR_COMMANDS.length : OPERATOR_COMMANDS.length;
-  };
-  const heading = (name) => OPERATOR_COMMANDS.includes(name) ? OPERATOR_HEADING : GENERAL_COMMANDS.includes(name) ? GENERAL_HEADING : ISSUES_HEADING;
-  for (const command of program2.commands) command.helpGroup(heading(command.name()));
-  program2.commands.sort(
-    (left, right) => rank(left.name()) - rank(right.name())
-  );
-  program2.commandsGroup(GENERAL_HEADING).helpCommand(true);
-}
-
 // src/core/upgrade.ts
 import { spawn as spawn2, spawnSync } from "child_process";
 import {
@@ -980,7 +1023,7 @@ import {
   statSync,
   writeFileSync
 } from "fs";
-import { basename as basename2, dirname, join as join2, parse, sep } from "path";
+import { basename, dirname, join as join2, parse, sep } from "path";
 import { fileURLToPath } from "url";
 var PACKAGE_NAME = "@allocator-one/harness-cli";
 var PACKAGE_NAMES = [PACKAGE_NAME, OPERATOR_PACKAGE];
@@ -1053,7 +1096,7 @@ function enclosingNodeModules(packageRoot) {
   let dir = dirname(packageRoot);
   const { root } = parse(dir);
   for (; ; ) {
-    if (basename2(dir) === "node_modules") return dir;
+    if (basename(dir) === "node_modules") return dir;
     if (dir === root) return null;
     dir = dirname(dir);
   }
@@ -1299,8 +1342,8 @@ function npmInstallGlobal(install, stillHeld) {
     };
   }
   process.stderr.write(
-    `harness: upgrading ${install.packageName ?? PACKAGE_NAME} \u2026
-`
+    named(`harness: upgrading ${install.packageName ?? PACKAGE_NAME} \u2026
+`)
   );
   const args = [
     "install",
@@ -1368,8 +1411,8 @@ function reexecSelf(env, argv2) {
   });
   if (result.error !== void 0) {
     process.stderr.write(
-      `harness: upgraded, but re-running failed: ${result.error.message}
-`
+      named(`harness: upgraded, but re-running failed: ${result.error.message}
+`)
     );
     return 1;
   }
@@ -1473,11 +1516,14 @@ function exitWith(code) {
 guardBrokenPipes();
 var program = new Command();
 var invokedAs = invokedName();
+function writeStderr(text) {
+  return process.stderr.write(named(text, invokedAs));
+}
 program.name(invokedAs).description(
   invokedAs === "operator" ? "drive Operator from the terminal and any agent, with Harness issue tracking alongside (harness.infra.one)" : "issue tracking for humans and agents (harness.infra.one)"
 ).exitOverride().configureOutput({
-  writeOut: (text) => process.stdout.write(text),
-  writeErr: (text) => process.stderr.write(text)
+  writeOut: (text) => process.stdout.write(named(text, invokedAs)),
+  writeErr: (text) => writeStderr(text)
 });
 function integer(value) {
   if (!/^\d+$/.test(value))
@@ -1518,17 +1564,17 @@ function interactive() {
   const ci = process.env["CI"];
   return process.stdout.isTTY === true && (ci === void 0 || ci === "");
 }
-async function withConfig(jsonFlag, mutating, run) {
+async function withConfig(jsonFlag, mutating, run2) {
   const resolved = resolveConfig();
-  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
+  for (const warning of resolved.warnings) writeStderr(warning + "\n");
   if (resolved.kind === "error") {
-    process.stderr.write(`harness: ${resolved.message}
+    writeStderr(`harness: ${resolved.message}
 `);
     return exitWith(2);
   }
   if (resolved.kind === "needs-login") {
     if (!interactive()) {
-      process.stderr.write(loginHelp(resolved.baseUrl));
+      writeStderr(loginHelp(resolved.baseUrl));
       return exitWith(2);
     }
     if (resolved.hostSource === "repo-config" && !isHostTrusted(resolved.baseUrl)) {
@@ -1536,7 +1582,7 @@ async function withConfig(jsonFlag, mutating, run) {
         `This repo's config (${resolved.repoConfigPath ?? ".harness-cli/config.json"}) targets ${resolved.baseUrl} \u2014 log in there? [y/N] `
       );
       if (answer.trim().toLowerCase() !== "y") {
-        process.stderr.write(
+        writeStderr(
           `harness: not logging in to ${resolved.baseUrl} \u2014 set HARNESS_API_URL to override the repo config
 `
         );
@@ -1546,31 +1592,31 @@ async function withConfig(jsonFlag, mutating, run) {
     }
     const loginResult = await login(resolved.baseUrl, {});
     if (!loginResult.ok) {
-      process.stderr.write(`harness: ${clean(loginResult.message)}
+      writeStderr(`harness: ${clean(loginResult.message)}
 `);
       return exitWith(1);
     }
-    process.stderr.write(loginResult.human);
+    writeStderr(loginResult.human);
     const again = resolveConfig();
     if (again.kind !== "ok") {
-      process.stderr.write(
+      writeStderr(
         `harness: still not signed in to ${resolved.baseUrl} after logging in
 `
       );
       return exitWith(1);
     }
-    return execute(again.config, jsonFlag, mutating, run);
+    return execute(again.config, jsonFlag, mutating, run2);
   }
-  return execute(resolved.config, jsonFlag, mutating, run);
+  return execute(resolved.config, jsonFlag, mutating, run2);
 }
-async function execute(config, jsonFlag, mutating, run) {
+async function execute(config, jsonFlag, mutating, run2) {
   const client = new Client(config);
   const hostNotice = mutating ? `\u2192 ${config.baseUrl}
 ` : "";
   try {
-    const output = await run({ client, config });
-    process.stderr.write(hostNotice);
-    if (output.notice !== void 0) process.stderr.write(output.notice);
+    const output = await run2({ client, config });
+    writeStderr(hostNotice);
+    if (output.notice !== void 0) writeStderr(output.notice);
     process.stdout.write(jsonFlag ? json(output.json) : output.human);
     return exitWith(output.exitCode ?? (output.partial === true ? 1 : 0));
   } catch (error) {
@@ -1579,16 +1625,16 @@ async function execute(config, jsonFlag, mutating, run) {
 }
 async function fail(error, hostNotice) {
   if (error instanceof UsageError) {
-    process.stderr.write(error.message + "\n");
+    writeStderr(error.message + "\n");
     return exitWith(2);
   }
   if (error instanceof LocalError) {
-    process.stderr.write(`harness: ${clean(error.message)}
+    writeStderr(`harness: ${clean(error.message)}
 `);
     return exitWith(1);
   }
   if (error instanceof TransportError) {
-    process.stderr.write(
+    writeStderr(
       hostNotice + `harness: cannot reach the API: ${clean(error.message)}
 `
     );
@@ -1598,21 +1644,21 @@ async function fail(error, hostNotice) {
     const healed = selfHeal();
     if (healed.kind === "upgraded") return exitWith(healed.code);
     const why = healed.kind === "failed" ? ` (tried to upgrade: ${clean(healed.reason)})` : "";
-    process.stderr.write(
+    writeStderr(
       hostNotice + `harness: ${clean(error.message)} (HTTP 426)${why}
 `
     );
     return exitWith(1);
   }
   if (error instanceof HttpError) {
-    process.stderr.write(
+    writeStderr(
       hostNotice + `harness: ${clean(error.message)} (HTTP ${error.status})${errorDetails(error.body)}
 `
     );
     return exitWith(1);
   }
   if (error instanceof CommandError) {
-    process.stderr.write(hostNotice + `harness: ${clean(error.message)}
+    writeStderr(hostNotice + `harness: ${clean(error.message)}
 `);
     return exitWith(1);
   }
@@ -2040,6 +2086,32 @@ ${NOT_RETRIED}`
   await withConfig(opts.json === true, true, (ctx) => jobPause(ctx, id));
 });
 var NOT_IDEMPOTENT = "Not idempotent: it is sent once and never retried, not after a timeout or a 5xx either. Exit 3 means the request never reached the server, so nothing changed. When it may have, the outcome is unknown: it exits 1 and says so. Then check";
+program.command("run").description("start an Operator job from an outcome, as Run as job does in the app; --watch follows it").argument("[outcome...]").option("--budget <usd>", "US dollars the organization's monthly Operator budget must still have (admins only)", once("--budget")).option("--skill <name>", "run one of the organization's Operator skills, by invocation name (/name)", once("--skill")).option("--watch", "follow the job like `watch --through-waits`; it never approves").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Starts a job for you in a new org chat of yours, under your own current rights.
+Prints the job id, its state and its workbench link, and the approval link
+while a change set waits for approval. Approving happens in the app; the CLI
+never approves. You can start 30 jobs an hour. ${NOT_IDEMPOTENT} \`jobs --mine\` for the new job before running it again.
+
+With --watch the job is followed until it completes (exit 0) or fails or is
+cancelled (exit ${EXIT_JOB_ENDED}). When it waits for a person, the approval link is printed and the
+watch keeps waiting; Ctrl-C stops it (exit ${EXIT_INTERRUPTED}) and stderr says how to resume.
+`
+).action(async (words, opts) => {
+  const request = prepareRun(words.join(" "), { budget: opts.budget, skill: opts.skill });
+  const json2 = opts.json === true;
+  await withConfig(
+    json2,
+    true,
+    (ctx) => run(ctx, request, {
+      watch: opts.watch === true,
+      json: json2,
+      onLine: (line) => process.stdout.write(line),
+      signal: opts.watch === true ? watchStopSignal() : void 0
+    })
+  );
+});
 function once(flag) {
   return (value, previous) => {
     if (previous !== void 0) throw new InvalidArgumentError(`${flag} given twice \u2014 pass it once`);
@@ -2406,7 +2478,7 @@ program.command("skills").description("the organization's skills assigned to Ope
   await withConfig(opts.json === true, false, (ctx) => skillsList(ctx));
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-O7CX2ZCC.js");
+  const { startMcpServer } = await import("./server-KVRQBVXI.js");
   await startMcpServer(invokedAs);
 });
 var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
@@ -2436,11 +2508,11 @@ program.command("login").description("sign in via the browser (infra.one session
   async (opts) => {
     const repoLookup = findRepoConfig();
     for (const warning of repoLookup.warnings)
-      process.stderr.write(warning + "\n");
+      writeStderr(warning + "\n");
     const repoUrl = repoLookup.config?.url;
     const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
     if (url === repoUrl && opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0) {
-      process.stderr.write(
+      writeStderr(
         `harness: host ${url} comes from ${repoLookup.config?.path}
 `
       );
@@ -2456,14 +2528,14 @@ program.command("logout").description("revoke and forget the stored login").opti
 program.command("whoami").description("show the resolved host and credential source").option("--json", "emit JSON").action(async (opts) => {
   const resolved = resolveConfig();
   for (const warning of resolved.warnings)
-    process.stderr.write(warning + "\n");
+    writeStderr(warning + "\n");
   if (resolved.kind === "error") {
-    process.stderr.write(`harness: ${resolved.message}
+    writeStderr(`harness: ${resolved.message}
 `);
     return exitWith(2);
   }
   if (resolved.kind === "needs-login") {
-    process.stderr.write(loginHelp(resolved.baseUrl));
+    writeStderr(loginHelp(resolved.baseUrl));
     return exitWith(2);
   }
   const source = blankToUndefined(process.env["HARNESS_API_TOKEN"]) !== void 0 ? "environment" : "stored login";
@@ -2472,7 +2544,7 @@ program.command("whoami").description("show the resolved host and credential sou
     result = await whoami(resolved.config, source);
   } catch (error) {
     if (!(error instanceof TransportError)) throw error;
-    process.stderr.write(`harness: cannot reach the API: ${clean(error.message)}
+    writeStderr(`harness: cannot reach the API: ${clean(error.message)}
 `);
     return exitWith(3);
   }
@@ -2489,7 +2561,7 @@ async function finishAuth(result, json2) {
     process.stdout.write(json2 ? json(result.json) : result.human);
     return exitWith(0);
   }
-  process.stderr.write(`harness: ${clean(result.message)}
+  writeStderr(`harness: ${clean(result.message)}
 `);
   return exitWith(1);
 }
@@ -2501,7 +2573,7 @@ if (argv[2] === UPDATE_CHECK_COMMAND) {
 }
 try {
   const notice = updateCheck();
-  if (notice !== null) process.stderr.write(notice);
+  if (notice !== null) writeStderr(notice);
 } catch {
 }
 if (invokedAs === "operator") layoutOperatorHelp(program);
@@ -2513,7 +2585,7 @@ try {
   await program.parseAsync(argv);
 } catch (error) {
   if (error instanceof UsageError) {
-    process.stderr.write(error.message + "\n");
+    writeStderr(error.message + "\n");
     await exitWith(2);
   }
   if (error instanceof CommanderError) {

package/dist/{login-page-UVUKFFTT.js → login-page-KGEJFFXR.js}

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+import {
+  invokedName,
+  named
+} from "./chunk-FQWV5MIC.js";
 
 // src/core/login-page.ts
 import { createHash } from "crypto";
@@ -157,8 +161,10 @@ var TERMINAL_SCRIPT = `(function () {
 
   void play();
 })();`;
-var NORMALIZED_TERMINAL_SCRIPT = TERMINAL_SCRIPT.replace(/\r\n/g, "\n");
-var TERMINAL_SCRIPT_HASH = createHash("sha256").update(NORMALIZED_TERMINAL_SCRIPT).digest("base64");
+function terminalScript(name) {
+  const script = named(TERMINAL_SCRIPT, name).replace(/\r\n/g, "\n");
+  return { script, hash: createHash("sha256").update(script).digest("base64") };
+}
 var PRESENTATION = {
   success: {
     eyebrow: "Login complete",
@@ -176,7 +182,8 @@ var PRESENTATION = {
 function escapeHtml(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-function loginPage(message, state) {
+function loginPage(message, state, name = invokedName()) {
+  const { script, hash } = terminalScript(name);
   const resolvedState = Object.hasOwn(PRESENTATION, state) ? state : "waiting";
   const { eyebrow, heading } = PRESENTATION[resolvedState];
   const safeEyebrow = escapeHtml(eyebrow);
@@ -187,7 +194,7 @@ function loginPage(message, state) {
 <html lang="en"><head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src data:; img-src data:; script-src 'sha256-${TERMINAL_SCRIPT_HASH}'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src data:; img-src data:; script-src 'sha256-${hash}'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
 <meta name="color-scheme" content="light">
 <title>${safeHeading} \xB7 Harness</title>
 <style>
@@ -281,7 +288,7 @@ function loginPage(message, state) {
         <div class="terminal-stream" data-terminal-stream aria-hidden="true"></div>
       </div>
     </div>
-    <script>${NORMALIZED_TERMINAL_SCRIPT}</script>` : ""}
+    <script>${script}</script>` : ""}
   </aside>
 </main>
 </body></html>