@allocator-one/harness-cli 1.15.0 → 1.16.0

package/dist/{chunk-I2S2JVCQ.js → chunk-GVTZKAXC.js}

@@ -1,4 +1,10 @@
 #!/usr/bin/env node
+import {
+  CLI_PACKAGE,
+  CLI_VERSION,
+  invokedName,
+  named
+} from "./chunk-FQWV5MIC.js";
 
 // src/core/errors.ts
 var HttpError = class extends Error {
@@ -52,14 +58,6 @@ var CommandError = class extends Error {
   }
 };
 
-// src/version.ts
-import { readFileSync } from "fs";
-var pkg = JSON.parse(
-  readFileSync(new URL("../package.json", import.meta.url), "utf8")
-);
-var CLI_VERSION = pkg.version;
-var CLI_PACKAGE = pkg.name;
-
 // src/core/expert.ts
 var EXPERT_TOKEN_PREFIX = "pxc_";
 var EXPERT_ASSIGNMENTS_PATH = "/api/v1/expert/assignments";
@@ -93,9 +91,15 @@ var DEFAULT_MESSAGES = {
   404: "Not found",
   409: "Conflict",
   422: "Validation error",
-  426: "CLI too old for this API \u2014 upgrade: npm i -g @allocator-one/harness-cli@latest",
+  426: `CLI too old for this API \u2014 upgrade: npm i -g ${CLI_PACKAGE}@latest`,
   429: "Rate limited \u2014 retry later"
 };
+var API_VERSION_HEADER = "x-harness-api-version";
+var STATS_PATH = "/api/v1/stats";
+var SESSION_PATH = "/api/v1/session";
+function isLoginCredential(token) {
+  return !token.startsWith("aone_") && !isExpertToken(token);
+}
 var Client = class {
   constructor(config) {
     this.config = config;
@@ -153,16 +157,32 @@ var Client = class {
       throw new TransportError(transportMessage(error), transportCode(error));
     }
   }
+  /**
+   * A GET that also hands back the server's API version header, so a probe
+   * that verifies a credential reports the version without a second
+   * request. Errors map as for `get`.
+   */
+  async getVersioned(path2) {
+    const response = await this.raw("GET", path2, {});
+    const apiVersion = response.headers.get(API_VERSION_HEADER);
+    return { envelope: await this.json(response), apiVersion };
+  }
   /**
    * The server's API version, for `version`'s server side. The header rides
-   * on every response — the versioning plug runs before auth — so even a
-   * 401 answers. A pxc_ credential probes the one route it reaches, so the
-   * probe is never a refusal in the server's log.
+   * on every response of a route the server has — the versioning plug runs
+   * before auth — so even a 401 answers. Each credential probes a route it
+   * reaches, so the probe is never a refusal in the server's log: a pxc_
+   * credential its assignments, a login credential of either kind (the
+   * Operator-only one reaches no tracker read) GET /api/v1/session, and an
+   * aone_ token the stats. A server older than GET /api/v1/session answers
+   * that route's 404 without the header, so the stats answer then.
    */
   async serverVersion() {
-    const path2 = isExpertToken(this.config.token) ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats";
-    const response = await this.raw("GET", path2, {});
-    return response.headers.get("x-harness-api-version") ?? "unknown";
+    const token = this.config.token;
+    const path2 = isExpertToken(token) ? EXPERT_ASSIGNMENTS_PATH : isLoginCredential(token) ? SESSION_PATH : STATS_PATH;
+    const version2 = (await this.raw("GET", path2, {})).headers.get(API_VERSION_HEADER);
+    if (version2 !== null || path2 !== SESSION_PATH) return version2 ?? "unknown";
+    return (await this.raw("GET", STATS_PATH, {})).headers.get(API_VERSION_HEADER) ?? "unknown";
   }
   // Only an explicitly configured actor is sent, and never over one the
   // caller already put in the body.
@@ -311,6 +331,7 @@ function issueDetail(issue, images = []) {
     ["Priority", issue["priority_label"]],
     ["Assignee", path(issue, "assignee", "name")],
     ["Team", path(issue, "team", "key")],
+    ["Plan", issuePlanLine(issue["plan"])],
     ["Labels", labelsLine(issue["labels"])],
     ["Blocked", blockedLine(issue)],
     ["Waiting", waitingLine(issue)],
@@ -715,6 +736,34 @@ function roleName(role) {
   return words.charAt(0).toUpperCase() + words.slice(1);
 }
 var LIVE_PLAN_STATUSES = ["released", "running", "needs_attention"];
+function plansTable(plans) {
+  const rows = plans.map((plan) => [
+    str(plan["root"]) || "-",
+    str(plan["status"]) || "-",
+    plan["held"] === true ? "yes" : plan["held"] === false ? "no" : "-",
+    typeof plan["revision"] === "number" ? String(plan["revision"]) : "-",
+    truncate(plan["title"])
+  ]);
+  return table(["ROOT", "STATUS", "HELD", "REVISION", "TITLE"], rows);
+}
+function issuePlanLine(plan) {
+  if (typeof plan !== "object" || plan === null || Array.isArray(plan)) return null;
+  const record = plan;
+  const root = clean(record["root"]);
+  if (root === "") return null;
+  const status = record["held"] === true ? "held" : clean(record["status"]);
+  const revision = record["revision"];
+  const parts = [root];
+  if (status !== "") parts.push(status);
+  if (typeof revision === "number") {
+    parts.push(`revision ${revision}`);
+    if (typeof record["in_revision"] === "boolean") parts.push(record["in_revision"] ? "in revision" : "not in revision");
+  } else {
+    parts.push("never released");
+  }
+  if (record["executor"] === "operator") parts.push("Operator step");
+  return parts.join(" \xB7 ");
+}
 function planDetail(plan) {
   const steps = records(plan["steps"]);
   const fields = [
@@ -843,7 +892,7 @@ function holderText(holder) {
 function planHeldSection(heldSteps) {
   if (!Array.isArray(heldSteps) || heldSteps.length === 0) return "";
   return `
-Held by an edit until the plan is released again: ${heldSteps.map((step) => clean(step)).join(", ")}
+Changed since the release: ${heldSteps.map((step) => clean(step)).join(", ")} (only Operator steps are held until the next release takes them in)
 `;
 }
 function indentLines(text) {
@@ -863,11 +912,32 @@ function changesetDetails(details) {
 function violationDetails(violations) {
   return records(violations).map((violation) => {
     const code = clean(violation["code"]);
-    const message = clean(violation["message"]) || code || "invalid";
+    const message = capMessage(violation) ?? (clean(violation["message"]) || code || "invalid");
     return `
   ${violationSubject(violation)}: ${message}${code === "" ? "" : ` [${code}]`}`;
   }).join("");
 }
+var MAX_PLAN_STEPS_CEILING = 2e3;
+function capMessage(violation) {
+  if (violation["code"] !== "too_many_steps") return null;
+  const cap = violation["cap"];
+  if (typeof cap !== "object" || cap === null || Array.isArray(cap)) return null;
+  const { kind, max, count, ceiling: served } = cap;
+  if (!Number.isInteger(max) || !Number.isInteger(count)) return null;
+  if (kind === "operator_steps") {
+    return `the plan has ${count} Operator steps, above the fixed limit of ${max}: Operator's delegated grant caps a plan's agent steps, and no setting raises it \u2014 hand some to people (executor none) or split the plan`;
+  }
+  if (kind === "plan_steps") {
+    const ceiling = Number.isInteger(served) ? served : MAX_PLAN_STEPS_CEILING;
+    const over = `the plan has ${count} steps, above this organization's max plan steps (${max})`;
+    if (count > ceiling && max < ceiling) {
+      return `${over}, and above the ceiling of ${ceiling} that no setting raises past \u2014 split the plan`;
+    }
+    if (max >= ceiling) return `${over}, which is already at its ceiling of ${ceiling} \u2014 split the plan`;
+    return `${over}: a Harness admin can raise "Max plan steps" in Harness settings \u2192 Plans (max_plan_steps, up to ${ceiling})`;
+  }
+  return null;
+}
 function violationSubject(violation) {
   const key = typeof violation["key"] === "string" ? clean(violation["key"]) : null;
   const index = typeof violation["index"] === "number" ? `steps[${violation["index"]}]` : null;
@@ -966,7 +1036,7 @@ function path(record, ...keys) {
 }
 
 // src/commands/issues.ts
-import { openAsBlob, openSync, closeSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { openAsBlob, openSync, closeSync, readFileSync, statSync as statSync2 } from "fs";
 import { basename, extname } from "path";
 
 // src/core/attachments.ts
@@ -1165,6 +1235,9 @@ var UUID_FORMAT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
 function isUuid(value) {
   return UUID_FORMAT.test(value);
 }
+function isIdentifier(value) {
+  return IDENTIFIER_FORMAT.test(value);
+}
 function requireIdentifiers(identifiers) {
   const bad = identifiers.filter((identifier) => !IDENTIFIER_FORMAT.test(identifier));
   if (bad.length > 0) {
@@ -1198,7 +1271,7 @@ function requireReadyClaimArgs(opts) {
 async function claimNext(ctx, opts) {
   requireReadyClaimArgs(opts);
   const team = requiredTeam(ctx, opts.team);
-  const check = `check \`harness list --team ${team} --assignee me --status in_progress\``;
+  const check = `check \`${invokedName()} list --team ${team} --assignee me --status in_progress\``;
   const unreadable = (why) => new CommandError(`The claim-next response ${why}, so an issue may have been claimed \u2014 ${check}.`);
   let body;
   try {
@@ -1356,14 +1429,14 @@ async function prime(ctx) {
   const statsBody = await ctx.client.get("/api/v1/stats");
   const ready2 = markAgentSteps(await mostImportantReady(ctx));
   const json2 = { stats: statsBody.data, ready: ready2 };
-  const human = "# Harness workflow context\n\n" + stats(statsBody.data) + "\nReady to work:\n" + issuesTable(ready2, { markAgentSteps: true }) + `
+  const human = "# Harness workflow context\n\n" + stats(statsBody.data) + "\nReady to work:\n" + issuesTable(ready2, { markAgentSteps: true }) + named(`
 Workflow: harness ready \u2192 harness update <id> --claim \u2192 work \u2192
 harness close <id> --reason "Implemented in <commit-hash>" (response
 lists newly unblocked issues \u2014 surface them).
 Create tracked work BEFORE coding: harness create --title "\u2026" --type task.
 Dependencies: harness dep add <issue> <blocker> (blocker blocks issue).
 Before reporting done: close the issues you finished.
-`;
+`);
   return { json: json2, human };
 }
 async function mostImportantReady(ctx) {
@@ -1381,7 +1454,7 @@ async function version(config) {
   } else {
     server = await new Client(config).serverVersion().catch(() => "unreachable");
   }
-  return { json: { cli: CLI_VERSION, server }, human: `harness ${CLI_VERSION} (server API ${server})
+  return { json: { cli: CLI_VERSION, server }, human: `${invokedName()} ${CLI_VERSION} (server API ${server})
 ` };
 }
 async function create(ctx, opts) {
@@ -1494,18 +1567,42 @@ ${opts.appendNotes}`;
   return { json: issue, human };
 }
 var CLAIM_REFUSAL_HINTS = {
-  // The edit holds a released step, so the plan needs releasing again before
-  // the step is claimable.
-  agent_step: () => "Operator runs it for its plan; to do it yourself, set its executor to none (harness plan edit <plan-id>) and release the plan again",
-  waiting_on_condition: (identifier) => `harness show ${identifier} lists what it waits on; tick a gate with harness gate satisfy ${identifier} <gate>`
+  // A person never claims an Operator step, so releasing the plan is not the
+  // fix: handing the step to a person is, and a handed-over Operator step
+  // stays frozen until the next release.
+  agent_step: (_identifier, plan) => {
+    const runs = plan.kind === "sole" ? `plan ${plan.root}` : plan.kind === "nearest" ? `its plans (several govern it; the nearest is ${plan.root})` : "its plan";
+    const target = plan.kind === "sole" ? plan.root : "<plan>";
+    return `a person can't claim an Operator step: Operator runs it for ${runs}. To do it yourself, set its executor to none (${invokedName()} plan edit ${target}) and release the plan again`;
+  },
+  plan_not_released: (_identifier, plan) => planReleaseHint(plan),
+  not_in_plan_revision: (_identifier, plan) => planReleaseHint(plan),
+  edited_since_release: (_identifier, plan) => planReleaseHint(plan),
+  waiting_on_condition: (identifier) => `${invokedName()} show ${identifier} lists what it waits on; tick a gate with ${invokedName()} gate satisfy ${identifier} <gate>`
 };
+function planReleaseHint(plan) {
+  if (plan.kind === "sole") return plan.release ? `run ${invokedName()} plan release ${plan.root}` : void 0;
+  if (plan.kind === "nearest") {
+    return `several plans govern it; the nearest is ${plan.root} (${invokedName()} plan show ${plan.root})`;
+  }
+  return void 0;
+}
 function explainClaimRefusal(error, identifier) {
   if (!(error instanceof HttpError) || error.status !== 409) return error;
   const reason = error.body["reason"];
-  const hint = typeof reason === "string" && Object.hasOwn(CLAIM_REFUSAL_HINTS, reason) ? CLAIM_REFUSAL_HINTS[reason](identifier) : void 0;
+  const hint = typeof reason === "string" && Object.hasOwn(CLAIM_REFUSAL_HINTS, reason) ? CLAIM_REFUSAL_HINTS[reason](identifier, refusingPlan(error.body)) : void 0;
   if (hint === void 0) return error;
   return new HttpError(error.status, `${error.message} \u2014 ${hint}`, error.body, error.retryAfter);
 }
+function refusingPlan(body) {
+  const plan = body["plan"];
+  if (typeof plan !== "object" || plan === null || Array.isArray(plan)) return { kind: "none" };
+  const root = plan["root"];
+  if (typeof root !== "string" || !isIdentifier(root)) return { kind: "none" };
+  const message = typeof body["message"] === "string" ? body["message"] : "";
+  if (!new RegExp(`\\bplan ${root}\\b`).test(message)) return { kind: "nearest", root };
+  return { kind: "sole", root, release: new RegExp(`\\brelease plan ${root}\\b`).test(message) };
+}
 function requireCloseArgs(identifiers, opts) {
   if (identifiers.length === 0) {
     throw new UsageError(
@@ -1604,9 +1701,9 @@ async function archive(ctx, identifiers, opts) {
 }
 async function comments(ctx, identifier) {
   requireIdentifiers([identifier]);
-  const body = await ctx.client.get(`/api/v1/issues/${identifier}/comments`);
-  if (body.data.length === 0) return { json: body.data, human: "No comments.\n" };
-  const human = body.data.map((comment2) => {
+  const records5 = await completeCommentThread(ctx, identifier);
+  if (records5.length === 0) return { json: records5, human: "No comments.\n" };
+  const human = records5.map((comment2) => {
     const author = clean((comment2["author"] ?? {})["name"] ?? "unknown");
     const id = clean(comment2["id"] ?? "unknown id");
     const text = cleanMultiline(str2(comment2["body"])).split("\n").map((line) => "  " + line).join("\n");
@@ -1614,7 +1711,35 @@ async function comments(ctx, identifier) {
 ${text}
 `;
   }).join("\n");
-  return { json: body.data, human };
+  return { json: records5, human };
+}
+async function completeCommentThread(ctx, identifier) {
+  const pages = [];
+  const seen = /* @__PURE__ */ new Set();
+  let before;
+  for (; ; ) {
+    const page = await ctx.client.get(`/api/v1/issues/${identifier}/comments`, {
+      limit: 200,
+      before
+    });
+    if (!Array.isArray(page.data) || typeof page.meta?.has_more !== "boolean") {
+      throw new CommandError("Invalid comment pagination: expected a comment array and boolean meta.has_more; completeness unknown.");
+    }
+    const records5 = [];
+    for (const record of page.data) {
+      if (record === null || typeof record !== "object" || Array.isArray(record) || typeof record.id !== "string" || record.id.trim() === "" || seen.has(record.id)) {
+        throw new CommandError("Invalid comment pagination: missing or repeated comment id; completeness unknown.");
+      }
+      seen.add(record.id);
+      records5.push(record);
+    }
+    pages.push(records5);
+    if (!page.meta.has_more) return pages.reverse().flat();
+    if (records5.length === 0) {
+      throw new CommandError("Invalid comment pagination: has_more on an empty page; completeness unknown.");
+    }
+    before = records5[0]["id"];
+  }
 }
 async function dep(ctx, verb, issue, blocker) {
   requireIdentifiers([issue, blocker]);
@@ -1764,7 +1889,7 @@ async function attachFile(ctx, path2) {
 }
 async function uploadAttachment(ctx, path2, maxBytes) {
   attachableFile(path2, maxBytes);
-  const file = maxBytes === MAX_VIDEO_BYTES ? new File([await openAsBlob(path2)], basename(path2)) : new File([readFileSync2(path2)], basename(path2));
+  const file = maxBytes === MAX_VIDEO_BYTES ? new File([await openAsBlob(path2)], basename(path2)) : new File([readFileSync(path2)], basename(path2));
   requireAttachmentSize(path2, file.size, maxBytes);
   const form = new FormData();
   form.set("file", file);
@@ -1871,13 +1996,13 @@ async function prepareApplicableLabelIds(ctx, teamId, names) {
 }
 function applicableLabel(labels, input, teamId) {
   const normalized = normalizeLabelName(input);
-  const named = labels.filter((label) => normalizeLabelName(label["name"]) === normalized);
-  const teamMatches = named.filter((label) => label["team_id"] === teamId);
+  const named2 = labels.filter((label) => normalizeLabelName(label["name"]) === normalized);
+  const teamMatches = named2.filter((label) => label["team_id"] === teamId);
   if (teamMatches.length > 1) {
     throw new CommandError(`more than one team label matches "${input}"; use a label id`);
   }
   if (teamMatches.length === 1) return teamMatches[0];
-  const workspaceMatches = named.filter(
+  const workspaceMatches = named2.filter(
     (label) => label["team_id"] === null || label["team_id"] === void 0
   );
   if (workspaceMatches.length > 1) {
@@ -2003,8 +2128,8 @@ function listParams(ctx, opts) {
 }
 function optionalPriority(value) {
   if (value === void 0) return null;
-  const named = Object.hasOwn(PRIORITY_NAMES, value) ? PRIORITY_NAMES[value] : void 0;
-  if (named !== void 0) return named;
+  const named2 = Object.hasOwn(PRIORITY_NAMES, value) ? PRIORITY_NAMES[value] : void 0;
+  if (named2 !== void 0) return named2;
   if (/^\d+$/.test(value)) {
     throw new UsageError(
       `Bare numeric priorities are refused: bd and harness disagree on what
@@ -2518,7 +2643,7 @@ var APPROVAL_NOTE = "Write and send capabilities, and any proposal, need a perso
 var REFUSALS = {
   operator_disabled: "nothing here works until it is switched back on",
   operator_not_permitted: "this account has no admin or member role in the organization the credential is bound to",
-  actor_required: "this credential acts as no person: sign in with `harness login`, or use an API token minted for a user",
+  actor_required: `this credential acts as no person: sign in with \`${invokedName()} login\`, or use an API token minted for a user`,
   run_bound_credential: "a run-bound credential can't read Operator's catalog",
   forbidden: "Operator needs the operator:read scope (aone_ API tokens must be minted with it) and an admin or member role"
 };
@@ -2638,7 +2763,7 @@ function requireCapabilityId(id) {
     throw new UsageError(`not a capability id: ${clean(id)} (e.g. crm.party.search)`);
   }
   if (id === "domains") {
-    throw new UsageError("domains is not a capability id \u2014 `harness tools domains` lists the domains");
+    throw new UsageError(`domains is not a capability id \u2014 \`${invokedName()} tools domains\` lists the domains`);
   }
 }
 function requireSearchQuery(query) {
@@ -2995,9 +3120,9 @@ function jobPeople(job) {
   const participants = records3(field2(job, "people", "participants"));
   const owner = isRecord2(job["owner"]) ? job["owner"] : null;
   const names = /* @__PURE__ */ new Map();
-  for (const named of owner === null ? participants : [...participants, owner]) {
-    if (typeof named["user_id"] === "string" && typeof named["name"] === "string" && named["name"] !== "") {
-      if (!names.has(named["user_id"])) names.set(named["user_id"], named["name"]);
+  for (const named2 of owner === null ? participants : [...participants, owner]) {
+    if (typeof named2["user_id"] === "string" && typeof named2["name"] === "string" && named2["name"] !== "") {
+      if (!names.has(named2["user_id"])) names.set(named2["user_id"], named2["name"]);
     }
   }
   const person = (userId) => typeof userId === "string" && userId !== "" ? { user_id: userId, name: names.get(userId) ?? null } : null;
@@ -3090,7 +3215,8 @@ async function jobWatch(ctx, id, opts) {
   }
 }
 function resumeLine(id, after) {
-  return `harness: stopped watching job ${id}; resume with: harness watch ${id} --after ${after}
+  const name = invokedName();
+  return `${name}: stopped watching job ${id}; resume with: ${name} watch ${id} --after ${after}
 `;
 }
 function watchStopSignal(stdout = process.stdout, signals = process) {
@@ -3179,9 +3305,9 @@ async function eventsPage(ctx, id, after) {
 var REFUSAL_HINTS = {
   operator_disabled: "nothing can be read until Operator is switched back on for this organization",
   operator_not_permitted: "only the organization's admins and members use Operator; guests and people outside it cannot",
-  actor_required: "the credential acts as no person: sign in with `harness login`, or use an API token a person created",
-  forbidden: "the credential lacks the operator:read scope (`harness login` carries it; an aone_ token must be created with it, bound to this organization), or you are a guest or outside the organization",
-  run_bound_credential: "a run-bound credential cannot read Operator jobs; sign in with `harness login`"
+  actor_required: `the credential acts as no person: sign in with \`${invokedName()} login\`, or use an API token a person created`,
+  forbidden: `the credential lacks the operator:read scope (\`${invokedName()} login\` carries it; an aone_ token must be created with it, bound to this organization), or you are a guest or outside the organization`,
+  run_bound_credential: `a run-bound credential cannot read Operator jobs; sign in with \`${invokedName()} login\``
 };
 function missingJob(id) {
   return `no Operator job ${id} you can see: it does not exist, is in another organization, or is not shared with you (or this Harness server has no Operator API yet)`;
@@ -3567,10 +3693,10 @@ async function sendOnce(ctx, path2, body, write2) {
     throw error;
   }
 }
-function explainRefusal(error, notFound2, hints) {
+function explainRefusal(error, notFound2, hints2) {
   if (!(error instanceof HttpError) || error instanceof UpgradeRequiredError) return error;
   const code = typeof error.body["error"] === "string" ? error.body["error"] : "";
-  const own = Object.hasOwn(hints, code) ? hints[code] : void 0;
+  const own = Object.hasOwn(hints2, code) ? hints2[code] : void 0;
   let hint;
   if (error.status >= 500) hint = own;
   else if (error.status === 404) hint = notFound2;
@@ -3578,10 +3704,132 @@ function explainRefusal(error, notFound2, hints) {
   else if (error.status === 403 && Object.hasOwn(ACCESS_HINTS, code)) hint = ACCESS_HINTS[code];
   else if (error.status === 400 && code === "bad_request") hint = BAD_REQUEST_HINT;
   if (hint === void 0) return error;
-  const message = error.status >= 500 && typeof error.body["message"] === "string" ? error.body["message"] : error.message;
+  const message = error.status < 500 ? error.message : typeof error.body["message"] === "string" ? error.body["message"] : own !== void 0 ? `The server answered ${error.status}` : error.message;
   return new HttpError(error.status, `${message} \u2014 ${hint}`, error.body, error.retryAfter);
 }
 
+// src/commands/operator-run.ts
+var OUTCOME_MAX_CHARACTERS = 1e4;
+var BUDGET_MAX_DOLLARS = 1e6;
+var SKILL = /^\/?[a-z0-9]+(-[a-z0-9]+)*$/;
+var SKILL_MAX_CHARACTERS = 65;
+var BUDGET = /^\d+(\.\d{1,2})?$/;
+function prepareRun(outcome, opts = {}, surface = CLI_SURFACE) {
+  const trimmed = outcome.trim();
+  if (trimmed === "") throw new UsageError(`the outcome is empty \u2014 say what the job should achieve${surface.outcomeHint}`);
+  const length = graphemeLength(trimmed);
+  if (length > OUTCOME_MAX_CHARACTERS) {
+    throw new UsageError(
+      `the outcome is ${length} characters once trimmed; a job takes at most ${OUTCOME_MAX_CHARACTERS}`
+    );
+  }
+  const body = { outcome: trimmed };
+  if (opts.budget !== void 0) {
+    const budget = opts.budget.trim();
+    const amount = BUDGET.test(budget) ? Number(budget) : NaN;
+    if (!(amount > 0) || amount > BUDGET_MAX_DOLLARS) {
+      throw new UsageError(
+        `${surface.budget} takes a positive amount in US dollars with at most two decimals, up to ${BUDGET_MAX_DOLLARS}`
+      );
+    }
+    body["budget"] = amount;
+  }
+  if (opts.skill !== void 0) {
+    const skill = opts.skill.trim();
+    if (skill.length > SKILL_MAX_CHARACTERS || !SKILL.test(skill)) {
+      throw new UsageError(
+        `${surface.skill} takes a skill's invocation name, like /summarize-lps (${surface.skills} lists them)`
+      );
+    }
+    body["skill"] = skill;
+  }
+  return { body };
+}
+var CLI_SURFACE = {
+  budget: "--budget",
+  skill: "--skill",
+  outcomeHint: ': run "<outcome>"',
+  skills: "`skills`",
+  look: "`jobs --mine` for the new job",
+  again: "run again"
+};
+var MCP_SURFACE = {
+  budget: "budget",
+  skill: "skill",
+  outcomeHint: "",
+  skills: "`skills_list`",
+  look: "`jobs_list` with mine for the new job",
+  again: "call again"
+};
+async function startRun(ctx, request, surface = CLI_SURFACE) {
+  const write2 = { mayHave: "a job may have been started", check: surface.look };
+  let data;
+  try {
+    data = (await sendOnce(ctx, "/api/v1/operator/jobs", request.body, write2)).data;
+  } catch (error) {
+    throw explainRefusal(error, "this Harness server has no Operator API for starting jobs yet", hints(error, surface));
+  }
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    throw outcomeUnknown("the answer named no job", write2);
+  }
+  const record = data;
+  const jobId = record["job_id"];
+  if (typeof jobId !== "string" || jobId === "") throw outcomeUnknown("the answer named no job", write2);
+  const text = (value) => typeof value === "string" ? value : "";
+  return {
+    job_id: jobId,
+    state: text(record["state"]),
+    workbench_url: text(record["workbench_url"]),
+    approval_url: text(record["approval_url"]) === "" ? null : text(record["approval_url"])
+  };
+}
+function hints(error, surface) {
+  const retryAfter = error instanceof HttpError ? error.retryAfter : null;
+  return {
+    budget_not_permitted: `nothing was started: only the organization's admins, who manage its Operator budget, can pass ${surface.budget} \u2014 ${surface.again} without it`,
+    budget_exceeded: `nothing was started: the organization's monthly Operator budget has less than ${surface.budget} left this month \u2014 pass a smaller budget, or ask an admin`,
+    concurrent_change: `nothing was started: Operator or your access changed while the job started \u2014 check that you can still use Operator, then ${surface.again}`,
+    invalid_outcome: `nothing was started: pass the outcome as text of 1 to ${OUTCOME_MAX_CHARACTERS} characters once trimmed, without control characters`,
+    invalid_budget: `nothing was started: ${surface.budget} takes a positive amount in US dollars with at most two decimals, up to ${BUDGET_MAX_DOLLARS}`,
+    unknown_skill: `nothing was started: no Operator skill of that name that you may run in the organization (${surface.skills} lists them)`,
+    rate_limited: "nothing was started: you can start 30 jobs an hour this way" + (retryAfter === null ? "" : `; try again in ${clean(retryAfter)} s`),
+    service_unavailable: "nothing was started; try again later"
+  };
+}
+function startedText(job) {
+  return `Started Operator job ${clean(job.job_id)}.
+` + labelled([
+    ["State", clean(job.state) || null],
+    ["Workbench", clean(job.workbench_url) || null],
+    ["Approve at", job.approval_url === null ? null : clean(job.approval_url)]
+  ]) + (job.approval_url === null ? "" : "\nApproving happens in the app; the CLI cannot approve.\n");
+}
+async function run(ctx, request, opts = {}) {
+  const job = await startRun(ctx, request);
+  if (opts.watch !== true) return { json: job, human: startedText(job) };
+  const json2 = opts.json === true;
+  if (!json2) opts.onLine?.(startedText(job) + "\n");
+  let watched;
+  try {
+    watched = await jobWatch(ctx, job.job_id, {
+      throughWaits: true,
+      collectEvents: json2,
+      onLine: json2 ? void 0 : opts.onLine,
+      signal: opts.signal,
+      sleep: opts.sleep
+    });
+  } catch (error) {
+    const follow = ` \u2014 the job was started: follow it with \`watch ${job.job_id}\``;
+    if (error instanceof HttpError) {
+      throw new HttpError(error.status, `${error.message}${follow}`, error.body, error.retryAfter);
+    }
+    if (error instanceof TransportError) throw new TransportError(`${error.message}${follow}`, error.code);
+    if (error instanceof CommandError) throw new CommandError(`${error.message}${follow}`);
+    throw error;
+  }
+  return { ...watched, json: { ...job, watch: watched.json } };
+}
+
 // src/commands/operator-continue.ts
 async function jobContinue(ctx, id) {
   requireJobId(id);
@@ -3614,7 +3862,7 @@ function refusals(id) {
 }
 
 // src/core/textinput.ts
-import { readFileSync as readFileSync3, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync2, statSync as statSync3 } from "fs";
 import { isatty } from "tty";
 var STDIN_PATH = "-";
 var MAX_TEXT_BYTES = 1e6;
@@ -3672,7 +3920,7 @@ function readTextFile(path2, option, limit = TEXT_LIMIT) {
   if (path2 === STDIN_PATH) {
     let piped;
     try {
-      piped = readFileSync3(0);
+      piped = readFileSync2(0);
     } catch (error) {
       throw new UsageError(`${option} -: cannot read stdin (${describe(error)})`);
     }
@@ -3684,7 +3932,7 @@ function readTextFile(path2, option, limit = TEXT_LIMIT) {
   const flag = `${option} ${path2}`;
   let bytes;
   try {
-    bytes = readFileSync3(path2);
+    bytes = readFileSync2(path2);
   } catch (error) {
     throw new UsageError(`${flag}: ${describe(error)}`);
   }
@@ -3882,14 +4130,14 @@ function requireProcedureName(name) {
 }
 async function procedureSave(ctx, jobId, name) {
   requireJobId(jobId);
-  const named = requireProcedureName(name);
+  const named2 = requireProcedureName(name);
   const write2 = {
     mayHave: "a procedure may have been saved",
     check: `the job's procedures with \`job ${jobId}\``
   };
   let data;
   try {
-    data = (await sendOnce(ctx, `/api/v1/operator/jobs/${jobId}/procedures`, { name: named }, write2)).data;
+    data = (await sendOnce(ctx, `/api/v1/operator/jobs/${jobId}/procedures`, { name: named2 }, write2)).data;
   } catch (error) {
     throw explainRefusal(error, missingJob(jobId), {
       owner_required: "only the job's owner can save it as a procedure; ask them to save it",
@@ -4102,6 +4350,9 @@ import { parseDocument } from "yaml";
 var PLAN_EXECUTORS = ["none", "operator"];
 var CONDITION_KINDS = ["not_before", "gate", "event"];
 var GATE_OWNER_ROLES = ["gp", "compliance_officer", "valuer", "accountant", "auditor", "counsel"];
+var PLAN_STATUSES = ["held", "released", "running", "completed", "needs_attention"];
+var PLAN_LIST_MAX_LIMIT = 100;
+var PLAN_LIST_DEFAULT_LIMIT = 50;
 function parsePlanDocument(text, source) {
   const parsed = extname2(source).toLowerCase() === ".json" ? parseJson(text, source) : parseYamlDocument(text, source);
   if (!isRecord5(parsed)) {
@@ -4160,17 +4411,48 @@ async function planCreate(ctx, plan, opts) {
     human: `Created plan ${clean(id)} (${clean(created["status"]) || "held"})
 
 ` + planDetail(created) + `
-Nothing runs until it is released: harness plan release ${clean(id)}
+Nothing runs until it is released: ${invokedName()} plan release ${clean(id)}
 `
   };
 }
+function requirePlanListArgs(opts) {
+  if (opts.status !== void 0 && !PLAN_STATUSES.includes(opts.status)) {
+    throw new UsageError(`status must be one of: ${PLAN_STATUSES.join(", ")}`);
+  }
+  if (opts.limit !== void 0 && (!Number.isInteger(opts.limit) || opts.limit < 1 || opts.limit > PLAN_LIST_MAX_LIMIT)) {
+    throw new UsageError(`--limit takes 1 to ${PLAN_LIST_MAX_LIMIT}: the server returns at most ${PLAN_LIST_MAX_LIMIT} plans`);
+  }
+}
+async function planList(ctx, opts) {
+  requirePlanListArgs(opts);
+  const team = requiredTeam(ctx, opts.team);
+  let body;
+  try {
+    body = await ctx.client.get(`/api/v1/teams/${team}/plans`, { status: opts.status, limit: opts.limit });
+  } catch (error) {
+    throw explainMissing(error, `no team ${team} here, or this Harness server cannot list plans yet`);
+  }
+  if (!Array.isArray(body.data)) throw new CommandError("The plan list response carried no list.");
+  const list3 = body.data.filter(isRecord5);
+  const limit = opts.limit ?? PLAN_LIST_DEFAULT_LIMIT;
+  let notice;
+  if (list3.length >= limit) {
+    notice = limit < PLAN_LIST_MAX_LIMIT ? `harness: showing the newest ${list3.length} plans \u2014 pass --limit (up to ${PLAN_LIST_MAX_LIMIT}) for older ones.
+` : `harness: showing the newest ${list3.length} plans, the most one list returns \u2014 narrow it with --status.
+`;
+  }
+  const what = opts.status === void 0 ? "plans" : `${opts.status} plans`;
+  const human = list3.length === 0 ? `No ${what} in team ${team}.
+` : plansTable(list3);
+  return notice === void 0 ? { json: body.data, human } : { json: body.data, human, notice };
+}
 async function planShow(ctx, id) {
-  requirePlanId(id);
+  requirePlanRef(id);
   const plan = await planRequest(id, () => ctx.client.get(`/api/v1/plans/${id}`));
   return { json: plan, human: planDetail(plan) };
 }
 async function planEdit(ctx, id, edits) {
-  requirePlanId(id);
+  requirePlanRef(id);
   requireDocument(edits, "a plan edit is one object: steps to change and budgets");
   const plan = await planRequest(id, () => ctx.client.patch(`/api/v1/plans/${id}`, edits));
   const held = Array.isArray(plan["held_steps"]) && plan["held_steps"].length > 0;
@@ -4179,12 +4461,12 @@ async function planEdit(ctx, id, edits) {
     human: `Updated plan ${clean(id)}
 
 ` + planDetail(plan) + (held ? `
-Release it again to run the held steps: harness plan release ${clean(id)}
+Only Operator steps are held until the next release; release the plan again to take in the changes: ${invokedName()} plan release ${clean(id)}
 ` : "")
   };
 }
 async function planRelease(ctx, id, opts) {
-  requirePlanId(id);
+  requirePlanRef(id);
   const body = {};
   if (opts.collaborators !== void 0 && opts.collaborators.length > 0) body["collaborators"] = opts.collaborators;
   if (opts.retryBudget !== void 0) body["retry_budget"] = opts.retryBudget;
@@ -4199,7 +4481,7 @@ async function planRelease(ctx, id, opts) {
   };
 }
 async function planHold(ctx, id) {
-  requirePlanId(id);
+  requirePlanRef(id);
   const plan = await planRequest(id, () => ctx.client.post(`/api/v1/plans/${id}/hold`));
   return {
     json: plan,
@@ -4212,25 +4494,41 @@ async function gateSet(ctx, issue, gate, satisfied) {
   const wanted = gate.trim();
   if (wanted === "") throw new UsageError("name the gate by its key, its label or its condition id");
   const expert = isExpertToken(ctx.config.token);
-  const list3 = await readConditions(ctx, issue, expert);
-  const target = findGate(list3, issue, wanted, expert);
+  let list3 = null;
+  if (!isUuid(wanted)) {
+    try {
+      list3 = await readConditions(ctx, issue, expert);
+    } catch (error) {
+      if (error instanceof HttpError && error.status === 403) {
+        throw new HttpError(
+          error.status,
+          `${error.message} \u2014 find the gate by its condition id; only Harness staff can list an issue's conditions`,
+          error.body,
+          error.retryAfter
+        );
+      }
+      throw error;
+    }
+  }
+  const target = list3 === null ? { id: wanted.toLowerCase(), label: wanted.toLowerCase() } : findGate(list3, issue, wanted, expert);
   const id = str7(target["id"]);
   let body;
   try {
     body = await ctx.client.put(`/api/v1/issues/${issue}/conditions/${id}/satisfaction`, { satisfied });
   } catch (error) {
-    throw await explainNotGateOwner(ctx, error, target, issue, satisfied);
+    throw await explainNotGateOwner(ctx, error, target, issue, satisfied, list3 !== null);
   }
-  const others = list3.filter((condition) => condition["id"] !== id && condition["satisfied"] !== true).length;
+  const others = list3?.filter((condition) => condition["id"] !== id && condition["satisfied"] !== true).length ?? 0;
   let tail = "";
-  if (satisfied && expert) {
+  if (satisfied && list3 !== null && expert) {
     tail = others > 0 ? ` \u2014 ${others} other gate${others === 1 ? "" : "s"} of yours on it ${others === 1 ? "is" : "are"} open` : "";
-  } else if (satisfied) {
+  } else if (satisfied && list3 !== null) {
     tail = others > 0 ? ` \u2014 it still waits on ${others} other condition${others === 1 ? "" : "s"}` : " \u2014 no other wait condition holds it";
   }
+  const label = list3 === null && isRecord5(body.data) ? body.data["label"] ?? id : target["label"];
   return {
     json: body.data,
-    human: `${satisfied ? "Satisfied" : "Un-satisfied"} gate "${clean(target["label"])}" on ${issue}${tail}
+    human: `${satisfied ? "Satisfied" : "Un-satisfied"} gate "${clean(label)}" on ${issue}${tail}
 `
   };
 }
@@ -4264,8 +4562,10 @@ async function readConditions(ctx, issue, expert) {
   if (!Array.isArray(conditions)) throw new CommandError("The conditions response carried no list.");
   return conditions.filter(isRecord5);
 }
-function requirePlanId(id) {
-  if (!isUuid(id)) throw new UsageError(`not a plan id: ${id} (expected the plan's UUID)`);
+function requirePlanRef(id) {
+  if (!isUuid(id) && !isIdentifier(id)) {
+    throw new UsageError(`not a plan: ${id} (expected the plan's id or its root issue's identifier, e.g. FR-1)`);
+  }
 }
 function requireDocument(value, what) {
   if (!isRecord5(value)) throw new UsageError(what);
@@ -4274,18 +4574,21 @@ async function planRequest(id, send) {
   try {
     return (await send()).data;
   } catch (error) {
-    throw explainMissing(error, `no plan ${id} in this organization, or this Harness server has no plan API yet`);
+    throw explainMissing(
+      error,
+      isUuid(id) ? `no plan ${id} in this organization, or this Harness server has no plan API yet` : `${id} roots no plan in this organization (${invokedName()} show ${id} names the plan an issue belongs to, by its root), or this Harness server opens plans by their id only`
+    );
   }
 }
 function explainMissing(error, why) {
   if (!(error instanceof HttpError) || error.status !== 404) return error;
   return new HttpError(404, `${error.message} \u2014 ${why}`, error.body, error.retryAfter);
 }
-async function explainNotGateOwner(ctx, error, gate, issue, satisfied) {
+async function explainNotGateOwner(ctx, error, gate, issue, satisfied, allowLookup) {
   if (!(error instanceof HttpError) || error.status !== 403 || error.body["reason"] !== "not_gate_owner") return error;
   let current;
   let currentOwner = error.body["owner"];
-  if (currentOwner !== null && !isRecord5(currentOwner)) {
+  if (allowLookup && currentOwner !== null && !isRecord5(currentOwner)) {
     try {
       const fresh = (await ctx.client.get(`/api/v1/issues/${issue}/conditions`)).data;
       if (Array.isArray(fresh)) current = fresh.filter(isRecord5).find((condition) => condition["id"] === gate["id"]);
@@ -4295,30 +4598,24 @@ async function explainNotGateOwner(ctx, error, gate, issue, satisfied) {
   }
   const owner = isRecord5(currentOwner) ? ownerText(currentOwner) : "";
   const subject = `its owner${owner === "" ? "" : `, ${owner},`}`;
-  const named = `gate "${clean((current ?? gate)["label"])}" on ${issue}`;
-  const message = satisfied ? `Cannot satisfy ${named}: only ${subject} can tick it` : `Cannot un-satisfy ${named}: only ${subject} or Harness staff can untick it`;
+  const named2 = `gate "${clean((current ?? gate)["label"])}" on ${issue}`;
+  const message = satisfied ? `Cannot satisfy ${named2}: only ${subject} can tick it` : `Cannot un-satisfy ${named2}: only ${subject} or Harness staff can untick it`;
   return new HttpError(error.status, message, error.body, error.retryAfter);
 }
 var gateLabel = (condition) => str7(condition["label"]).trim();
 var gateKey = (condition) => str7(condition["key"]);
 function exactMatches(conditions, wanted) {
-  const id = isUuid(wanted) ? wanted.toLowerCase() : null;
-  return conditions.filter((condition) => {
-    if (id !== null && str7(condition["id"]).toLowerCase() === id) return true;
-    if (condition["kind"] !== "gate") return false;
-    const key = gateKey(condition);
-    return key !== "" && key === (id ?? wanted) || gateLabel(condition) === wanted;
-  });
+  return conditions.filter(
+    (condition) => condition["kind"] === "gate" && (gateKey(condition) !== "" && gateKey(condition) === wanted || gateLabel(condition) === wanted)
+  );
 }
 function ambiguous(conditions, issue, wanted, matches) {
   const listed = matches.map((condition) => {
     const what = condition["kind"] === "gate" ? `gate ${gateName({ label: gateLabel(condition), key: gateKey(condition) })}` : `${clean(condition["kind"])} condition`;
     return `${clean(condition["id"])} (${what})`;
   }).join(", ");
-  const unnameable = matches.map((condition) => str7(condition["id"])).filter((id) => exactMatches(conditions, id).length !== 1).map((id) => clean(id));
-  const caveat = unnameable.length === 0 ? "" : ` (${unnameable.join(", ")} ${unnameable.length === 1 ? "is" : "are"} also another gate's key or label, so ${unnameable.length === 1 ? "it" : "they"} cannot be named by id)`;
   return new CommandError(
-    `several gates on ${issue} match "${wanted}": ${listed} \u2014 pass the condition id of the one you mean${caveat}`
+    `several gates on ${issue} match "${wanted}": ${listed} \u2014 pass the condition id of the one you mean`
   );
 }
 function findGate(conditions, issue, wanted, expert = false) {
@@ -4326,11 +4623,6 @@ function findGate(conditions, issue, wanted, expert = false) {
   if (exact.length > 1) throw ambiguous(conditions, issue, wanted, exact);
   if (exact.length === 1) {
     const only = exact[0];
-    if (only["kind"] !== "gate") {
-      throw new CommandError(
-        `condition ${wanted} on ${issue} is a ${clean(only["kind"])} condition \u2014 only a gate is satisfied by hand`
-      );
-    }
     return only;
   }
   const gates = conditions.filter((condition) => condition["kind"] === "gate");
@@ -4340,7 +4632,6 @@ function findGate(conditions, issue, wanted, expert = false) {
   );
   if (loose.length > 1) throw ambiguous(conditions, issue, wanted, loose);
   if (loose.length === 1) return loose[0];
-  if (isUuid(wanted)) throw new CommandError(`No condition ${wanted} on ${issue}${expert ? " that you own" : ""}.`);
   const none = expert ? `No gate of yours on ${issue}` : `No gate on ${issue}`;
   if (gates.length === 0) {
     throw new CommandError(`${none} matches "${wanted}" \u2014 ${expert ? "you own no gate on it" : "it has no gates"}`);
@@ -4373,7 +4664,8 @@ function isRecord6(value) {
 }
 
 // src/core/credentials.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { createHash } from "crypto";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir } from "os";
 import { dirname as dirname2, isAbsolute, join as join2 } from "path";
 function defaultCredentialsPath(env = process.env) {
@@ -4381,9 +4673,18 @@ function defaultCredentialsPath(env = process.env) {
   const base = xdg !== void 0 && xdg !== "" && isAbsolute(xdg) ? xdg : join2(homedir(), ".config");
   return join2(base, "harness", "credentials.json");
 }
+function orgCredentialsPath(path2, baseUrl, org) {
+  const url = new URL(baseUrl);
+  const host = url.origin + url.pathname.replace(/\/+$/, "");
+  const key = createHash("sha256").update(JSON.stringify([path2, host, org.toLowerCase()])).digest("hex");
+  return join2(dirname2(path2), `credentials-org-${key}.json`);
+}
+function validOrgId(org) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(org);
+}
 function readCredentials(path2) {
   try {
-    const parsed = JSON.parse(readFileSync4(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync3(path2, "utf8"));
     if (typeof parsed === "object" && parsed !== null) {
       const { url, token } = parsed;
       if (typeof url === "string" && typeof token === "string") return { url, token };
@@ -4410,7 +4711,7 @@ function deleteCredentials(path2) {
 }
 
 // src/core/repo-config.ts
-import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, parse } from "path";
 var CONFIG_RELATIVE_PATH = join3(".harness-cli", "config.json");
@@ -4429,7 +4730,7 @@ function findRepoConfig(startDir = process.cwd()) {
 function readRepoConfig(path2) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(path2, "utf8"));
+    parsed = JSON.parse(readFileSync4(path2, "utf8"));
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     return { config: null, warnings: [`harness: ignoring malformed ${path2} (${detail})`] };
@@ -4458,7 +4759,7 @@ function trustedHostsPath(env = process.env) {
 }
 function readTrustedHosts(env) {
   try {
-    const parsed = JSON.parse(readFileSync5(trustedHostsPath(env), "utf8"));
+    const parsed = JSON.parse(readFileSync4(trustedHostsPath(env), "utf8"));
     if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed["hosts"])) {
       return parsed["hosts"].filter(
         (host) => typeof host === "string"
@@ -4495,6 +4796,10 @@ function resolveConfig(env = process.env, credentialsPath, repo) {
   const envUrl = blankToNull(env["HARNESS_API_URL"]);
   const envToken = blankToNull(env["HARNESS_API_TOKEN"]);
   const repoUrl = repo?.url?.replace(/\/+$/, "") ?? null;
+  const org = envToken === null ? repo?.org?.toLowerCase() : void 0;
+  if (org !== void 0 && !validOrgId(org)) {
+    return { kind: "error", message: `repo org in ${repo?.path} must be an organization UUID`, warnings };
+  }
   let rawUrl;
   let hostSource;
   if (envUrl !== null) {
@@ -4513,6 +4818,9 @@ function resolveConfig(env = process.env, credentialsPath, repo) {
   } else if (repoUrl !== null) {
     rawUrl = repoUrl;
     hostSource = "repo-config";
+  } else if (org !== void 0) {
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
   } else if (stored !== null) {
     rawUrl = stored.url;
     hostSource = "stored-login";
@@ -4523,13 +4831,16 @@ function resolveConfig(env = process.env, credentialsPath, repo) {
   const validated = validateBaseUrl(rawUrl);
   if (!validated.ok) return { kind: "error", message: validated.message, warnings };
   const baseUrl = rawUrl.replace(/\/+$/, "");
+  const selectedPath = org === void 0 ? path2 : orgCredentialsPath(path2, baseUrl, org);
+  const selected = org === void 0 ? stored : readCredentials(selectedPath);
   let token;
   if (envToken !== null) {
     token = envToken;
-  } else if (stored !== null && normalize(stored.url) !== null && normalize(stored.url) === normalize(baseUrl)) {
-    token = stored.token;
+  } else if (selected !== null && normalize(selected.url) !== null && normalize(selected.url) === normalize(baseUrl)) {
+    token = selected.token;
   } else {
-    const result = { kind: "needs-login", baseUrl, hostSource, warnings };
+    const result = { kind: "needs-login", baseUrl, hostSource, credentialsPath: selectedPath, warnings };
+    if (org !== void 0) result.org = org;
     if (hostSource === "repo-config" && repo?.path !== void 0) result.repoConfigPath = repo.path;
     return result;
   }
@@ -4543,7 +4854,8 @@ function resolveConfig(env = process.env, credentialsPath, repo) {
       // the --team flag at the command layer) stays authoritative.
       team: blankToNull(env["HARNESS_TEAM"]) ?? repo?.team ?? null,
       cacheDir: resolveCacheDir(env),
-      hostSource
+      hostSource,
+      credentialsPath: selectedPath
     },
     warnings
   };
@@ -4582,21 +4894,22 @@ function validateBaseUrl(baseUrl) {
   }
   if (parsed.protocol === "https:" && parsed.hostname !== "") return { ok: true };
   if (parsed.protocol === "http:") {
-    if (["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname)) return { ok: true };
+    const host = parsed.hostname;
+    if (["localhost", "127.0.0.1", "[::1]"].includes(host) || host.endsWith(".localhost")) return { ok: true };
     return {
       ok: false,
-      message: `refusing plain-http HARNESS_API_URL (${baseUrl}) \u2014 the API token would travel in cleartext. Use https, or http against localhost only.`
+      message: `refusing plain-http HARNESS_API_URL (${baseUrl}) \u2014 the API token would travel in cleartext. Use https, or http against localhost, *.localhost, 127.0.0.1 or [::1] only.`
     };
   }
   return { ok: false, message: `HARNESS_API_URL must be an http(s) URL with a host, got: ${baseUrl}` };
 }
-function loginHelp(baseUrl) {
+function loginHelp(baseUrl, name = invokedName()) {
   return `Not signed in to ${baseUrl}.
 
 Interactively, in a terminal (not from inside an agent \u2014 the browser
 tab needs someone to see it):
 
-    harness login
+    ${name} login
 
 For agents and CI, mint an API token (admin \u2192 API tokens) with the
 harness:read scope \u2014 plus harness:write only where the workflow
@@ -4605,7 +4918,7 @@ creates or closes \u2014 set an expiry, and export it:
     export HARNESS_API_TOKEN=aone_...
 
 An outside expert uses the pxc_ credential minted in their expert view:
-export it the same way, or paste it into \`harness login --no-browser\`.
+export it the same way, or paste it into \`${name} login --no-browser\`.
 `;
 }
 function blankToNull(value) {
@@ -4620,12 +4933,12 @@ export {
   UsageError,
   LocalError,
   CommandError,
-  CLI_VERSION,
-  CLI_PACKAGE,
   EXPERT_ASSIGNMENTS_PATH,
   isExpertToken,
   EXPERT_LAPSED,
   explainExpertRefusal,
+  SESSION_PATH,
+  isLoginCredential,
   Client,
   clean,
   json,
@@ -4719,6 +5032,12 @@ export {
   jobShow,
   jobWatch,
   watchStopSignal,
+  OUTCOME_MAX_CHARACTERS,
+  BUDGET_MAX_DOLLARS,
+  prepareRun,
+  MCP_SURFACE,
+  startRun,
+  run,
   jobContinue,
   resolveTextSources,
   STEER_MAX_CHARACTERS,
@@ -4736,17 +5055,23 @@ export {
   PLAN_EXECUTORS,
   CONDITION_KINDS,
   GATE_OWNER_ROLES,
+  PLAN_STATUSES,
+  PLAN_LIST_MAX_LIMIT,
   readPlanFile,
   planCreate,
+  requirePlanListArgs,
+  planList,
   planShow,
   planEdit,
   planRelease,
   planHold,
   gateSet,
   conditionList,
-  requirePlanId,
+  requirePlanRef,
   assignments,
   defaultCredentialsPath,
+  orgCredentialsPath,
+  validOrgId,
   readCredentials,
   writeCredentials,
   deleteCredentials,