@allocator-one/harness-cli 1.15.0 → 1.16.0

package/dist/cli.js

@@ -1,8 +1,6 @@
 #!/usr/bin/env node
 import {
   ACTIVITY_MAX_LIMIT,
-  CLI_PACKAGE,
-  CLI_VERSION,
   Client,
   CommandError,
   DEFAULT_BASE_URL,
@@ -16,8 +14,11 @@ import {
   JOBS_MAX_PAGES,
   JOB_STATES,
   LocalError,
+  PLAN_LIST_MAX_LIMIT,
+  PLAN_STATUSES,
   RELATION_CREATE_TYPES,
   RELATION_UPDATE_TYPES,
+  SESSION_PATH,
   STEER_MAX_CHARACTERS,
   TransportError,
   UpgradeRequiredError,
@@ -50,6 +51,7 @@ import {
   instructionFrom,
   isExpertToken,
   isHostTrusted,
+  isLoginCredential,
   jobCancel,
   jobContinue,
   jobPause,
@@ -73,12 +75,15 @@ import {
   memberSetRole,
   milestoneCreate,
   milestoneList,
+  orgCredentialsPath,
   planCreate,
   planEdit,
   planHold,
+  planList,
   planRelease,
   planShow,
   prepareProcedureRun,
+  prepareRun,
   prime,
   procedureSave,
   procedureShow,
@@ -99,7 +104,8 @@ import {
   requireIdentifiers,
   requireJobId,
   requireJobsArgs,
-  requirePlanId,
+  requirePlanListArgs,
+  requirePlanRef,
   requireProcedureId,
   requireProcedureName,
   requireReadyClaimArgs,
@@ -110,6 +116,7 @@ import {
   resolveCacheHome,
   resolveConfig,
   resolveTextSources,
+  run,
   search,
   show,
   skillsList,
@@ -131,13 +138,21 @@ import {
   update,
   upload,
   userList,
+  validOrgId,
   validateBaseUrl,
   validateIdempotencyKey,
   version,
   watchStopSignal,
   workflowStates,
   writeCredentials
-} from "./chunk-I2S2JVCQ.js";
+} from "./chunk-GVTZKAXC.js";
+import {
+  CLI_VERSION,
+  OPERATOR_PACKAGE,
+  invokedName,
+  layoutOperatorHelp,
+  named
+} from "./chunk-FQWV5MIC.js";
 
 // src/cli.ts
 import { createInterface as createInterface2 } from "readline";
@@ -267,8 +282,10 @@ async function exec(ctx, opts) {
     const missing = unstoredSlugs(requested, stored);
     if (missing.length > 0) {
       process.stderr.write(
-        `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
+        named(
+          `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
 `
+        )
       );
     }
   }
@@ -325,6 +342,172 @@ async function exec(ctx, opts) {
   return { json: { exit_code: exitCode }, human: "", exitCode };
 }
 
+// src/commands/review.ts
+import { execFileSync } from "child_process";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var SLUG = /^([\w.-]+)\/([\w.-]+)$/;
+function githubSlug(remote) {
+  const match = /^(?:(?:https?|ssh|git):\/\/(?:[^@/\s]+@)?|[\w.-]+@)github\.com[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/i.exec(remote.trim());
+  return match ? `${match[1]}/${match[2]}` : void 0;
+}
+function originRemote() {
+  try {
+    const url = execFileSync("git", ["remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return githubSlug(url);
+  } catch {
+    return void 0;
+  }
+}
+function prNumber(digits, input) {
+  const number = Number(digits);
+  if (!Number.isSafeInteger(number) || number < 1) throw new UsageError(`not a pull request number: ${input}`);
+  return number;
+}
+var NAME = /^[\w.-]+$/;
+function fromUrl(input) {
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    return null;
+  }
+  if (!["https:", "http:"].includes(url.protocol) || !/^(www\.)?github\.com$/i.test(url.hostname)) return null;
+  let segments;
+  try {
+    segments = url.pathname.split("/").filter((segment) => segment !== "").map(decodeURIComponent);
+  } catch {
+    return null;
+  }
+  const [owner, repo, kind, number] = segments;
+  if (kind !== "pull" || !owner || !repo || !number || !NAME.test(owner) || !NAME.test(repo) || !/^\d+$/.test(number)) {
+    return null;
+  }
+  return [owner, repo, number];
+}
+function parsePullRequest(input, repo, origin = originRemote) {
+  const trimmed = input.trim();
+  const url = fromUrl(trimmed);
+  if (url) return { owner: url[0], repo: url[1], number: prNumber(url[2], input) };
+  const named2 = /^([\w.-]+)\/([\w.-]+)#(\d+)$/.exec(trimmed);
+  if (named2) return { owner: named2[1], repo: named2[2], number: prNumber(named2[3], input) };
+  const bare = /^#?(\d+)$/.exec(trimmed);
+  if (!bare) throw new UsageError(`not a pull request: ${input} \u2014 use owner/repo#<pr>, its URL, or <pr> with --repo`);
+  const slug = repo ?? origin();
+  const parts = slug === void 0 ? null : SLUG.exec(slug.trim());
+  if (!parts) throw new UsageError("name the repository: owner/repo#<pr>, the pull request URL, or --repo owner/repo");
+  return { owner: parts[1], repo: parts[2], number: prNumber(bare[1], input) };
+}
+var label = (pr) => `${pr.owner}/${pr.repo}#${pr.number}`;
+var gatePath = (pr) => `/api/v1/reviews/prs/${encodeURIComponent(pr.owner)}/${encodeURIComponent(pr.repo)}/${pr.number}`;
+async function fetchGate(ctx, pr) {
+  const body = await ctx.client.get(gatePath(pr));
+  if (!isRecord2(body.data)) throw new CommandError(`unexpected gate status for ${label(pr)}: no data`);
+  return body.data;
+}
+function latestAttempt(lifecycle) {
+  const attempts = Array.isArray(lifecycle["attempts"]) ? lifecycle["attempts"].filter(isRecord2) : [];
+  return attempts.reduce(
+    (latest, attempt) => latest === void 0 || Number(attempt["number"]) > Number(latest["number"]) ? attempt : latest,
+    void 0
+  );
+}
+function recovery(lifecycle) {
+  const latest = latestAttempt(lifecycle);
+  const sent = isRecord2(lifecycle["recovery"]) ? lifecycle["recovery"] : void 0;
+  const state2 = String(sent?.["state"] ?? latest?.["state"] ?? "");
+  if (state2 !== "failed" && state2 !== "timed_out") return void 0;
+  const reason = sent?.["terminal_reason"] ?? latest?.["terminal_reason"];
+  return {
+    number: latest?.["number"],
+    state: state2 === "timed_out" ? "timed out" : state2,
+    reason: typeof reason === "string" ? reason : null,
+    evidence: sent ? sent["evidence_recorded"] === true : latest?.["review_run_id"] != null,
+    next: sent?.["next"] === "automatic_retry" ? "automatic_retry" : "retry"
+  };
+}
+function describe(r) {
+  const why = [r.reason, r.evidence ? null : "no evidence recorded"].filter((part) => part !== null).join(", ");
+  return `attempt ${clean(String(r.number))} ${r.state}${why === "" ? "" : ` (${clean(why)})`}`;
+}
+function projection(gate2, key) {
+  const value = gate2[key];
+  return isRecord2(value) && typeof value["status"] === "string" ? clean(value["status"]) : "unknown";
+}
+async function status(ctx, pr) {
+  const gate2 = await fetchGate(ctx, pr);
+  const lifecycle = isRecord2(gate2["lifecycle"]) ? gate2["lifecycle"] : void 0;
+  const head = isRecord2(gate2["head"]) && typeof gate2["head"]["sha"] === "string" ? gate2["head"]["sha"].slice(0, 10) : "?";
+  const lines = [
+    `${label(pr)} at ${clean(head)}`,
+    `enforced: ${projection(gate2, "enforced")}   advisory: ${projection(gate2, "advisory")}`
+  ];
+  if (lifecycle) {
+    lines.push(`gate check: ${clean(String(lifecycle["state"] ?? "unknown")).replaceAll("_", " ")}`);
+    const r = recovery(lifecycle);
+    if (r) {
+      lines.push(`latest ${describe(r)}`);
+      lines.push(
+        r.next === "automatic_retry" ? "Harness retries it automatically; check again shortly." : named(`Retry it with: harness review retry ${label(pr)} --reason "\u2026"`)
+      );
+    }
+  }
+  return { json: gate2, human: lines.join("\n") + "\n" };
+}
+var REFUSALS = {
+  execution_not_terminal: "the latest attempt is still running; wait for it to finish",
+  attempt_changed: "another attempt was created meanwhile; read the status and run this again",
+  check_changed: "the head's gate check changed meanwhile; run this again",
+  head_changed: "the pull request's head moved; the new head gets its own check",
+  advisory_not_converged: "the head's advisory review has not converged; converge it first",
+  retry_conflict: "this attempt was already retried with a different reason",
+  merged: "the pull request is merged"
+};
+async function retry(ctx, pr, reason) {
+  const gate2 = await fetchGate(ctx, pr);
+  const lifecycle = isRecord2(gate2["lifecycle"]) ? gate2["lifecycle"] : void 0;
+  if (!lifecycle || typeof lifecycle["check_id"] !== "string" || typeof lifecycle["head_sha"] !== "string") {
+    throw new CommandError(`${label(pr)} has no gate check at its current head: nothing to retry`);
+  }
+  const r = recovery(lifecycle);
+  if (r?.next === "automatic_retry") {
+    throw new CommandError(named(`Harness retries attempt ${clean(String(r.number))} itself; run harness review status ${label(pr)} shortly`));
+  }
+  const previous = latestAttempt(lifecycle);
+  const previousId = typeof previous?.["id"] === "string" ? previous["id"] : null;
+  const body = {
+    head_sha: lifecycle["head_sha"],
+    check_id: lifecycle["check_id"],
+    previous_attempt_id: previousId,
+    // One key per attempt retried: running this again for the same attempt returns the attempt already
+    // queued instead of paying for another review run.
+    request_key: `harness-cli:${previousId ?? lifecycle["check_id"]}`,
+    reason: reason?.trim() || "Retry requested with harness review retry"
+  };
+  let response;
+  try {
+    response = await ctx.client.post(`${gatePath(pr)}/retry`, body, { actor: false });
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 409) {
+      const code = error.message.trim().split(/[\s:]+/).pop() ?? "";
+      throw new CommandError(`could not retry ${label(pr)}: ${REFUSALS[code] ?? clean(error.message)}`);
+    }
+    if (error instanceof HttpError && error.status === 403) {
+      throw new CommandError(`${error.message} \u2014 a retry needs a login with reviews:write`);
+    }
+    throw error;
+  }
+  const attempt = isRecord2(response.data) ? response.data : {};
+  const outcome = response["outcome"];
+  const verb = outcome === "existing" ? "Already queued" : "Queued";
+  return {
+    json: { attempt, outcome },
+    human: `${verb} attempt ${clean(String(attempt["number"]))} (${clean(String(attempt["id"]))}) for ${label(pr)}
+`
+  };
+}
+
 // src/core/auth.ts
 import { createHash, randomBytes } from "crypto";
 import { execFile } from "child_process";
@@ -338,9 +521,10 @@ var RESPONSE_FLUSH_TIMEOUT_MS = 2e3;
 var MAX_PAGE_RESPONSES = 4;
 var loginPageImport;
 function loadLoginPage() {
-  loginPageImport ??= import("./login-page-UVUKFFTT.js");
+  loginPageImport ??= import("./login-page-KGEJFFXR.js");
   return loginPageImport;
 }
+var NO_SESSION = { kind: null, expires_at: null, scopes: null, user: null, org: null };
 function generateState() {
   return randomBytes(24).toString("base64url");
 }
@@ -353,6 +537,9 @@ function challengeFor(verifier) {
 async function login(baseUrl, options = {}) {
   const validated = validateBaseUrl(baseUrl);
   if (!validated.ok) return { ok: false, message: validated.message };
+  if (options.org !== void 0 && !validOrgId(options.org)) {
+    return { ok: false, message: "org must be an organization UUID" };
+  }
   const base = baseUrl.replace(/\/+$/, "");
   if (options.noBrowser === true || !browserAvailable(options)) {
     return manualLogin(base, options);
@@ -425,6 +612,7 @@ async function loopbackLogin(baseUrl, options) {
       const detail = error instanceof Error ? error.message : String(error);
       return { ok: false, message: `could not open a browser: ${detail}` };
     }
+    if (options.org !== void 0) notify(`Choose organization ${options.org} on the login page; another organization's token will be refused.`);
     notify(`Opening ${url}`);
     notify("Waiting for the browser authorization (Ctrl-C to abort)\u2026");
     const callback = await callbackPromise;
@@ -439,7 +627,7 @@ async function loopbackLogin(baseUrl, options) {
         );
         return token;
       }
-      const result = await verifyAndStore(baseUrl, token.token, options);
+      const result = await verifyAndStore(baseUrl, token.token, options, { minted: true, kind: token.kind });
       if (result.ok) {
         await callback.respond(200, "You can close this browser and return to the terminal.", "success");
       } else {
@@ -492,7 +680,7 @@ function awaitCallback(server, state2, timeoutMs) {
       if (phase !== "waiting") return;
       const timeoutResponse = {
         status: 410,
-        message: "This login attempt has ended \u2014 run harness login again if needed.",
+        message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
         pageState: "error"
       };
       phase = "terminal";
@@ -511,15 +699,15 @@ function awaitCallback(server, state2, timeoutMs) {
     });
     server.on("request", (request, response) => {
       const respond = callbackResponder(response);
-      const respondWithPage = (status, message, pageState) => {
+      const respondWithPage = (status2, message, pageState) => {
         if (callbackPageResponses >= MAX_PAGE_RESPONSES) {
           respondEmpty(response, 429);
           return Promise.resolve();
         }
         callbackPageResponses += 1;
-        return respond(status, message, pageState);
+        return respond(status2, message, pageState);
       };
-      const respondAtRoot = (status, message, pageState) => {
+      const respondAtRoot = (status2, message, pageState) => {
         const rootPhase = phase === "terminal" ? "terminal" : "waiting";
         const responses = rootPageResponses.get(rootPhase) ?? 0;
         if (responses >= MAX_PAGE_RESPONSES) {
@@ -527,7 +715,7 @@ function awaitCallback(server, state2, timeoutMs) {
           return Promise.resolve();
         }
         rootPageResponses.set(rootPhase, responses + 1);
-        return respond(status, message, pageState);
+        return respond(status2, message, pageState);
       };
       let url;
       try {
@@ -564,7 +752,7 @@ function awaitCallback(server, state2, timeoutMs) {
         }
         const result = finalResponse ?? {
           status: 410,
-          message: "This login attempt has ended \u2014 run harness login again if needed.",
+          message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
           pageState: "error"
         };
         void trackResponse(respondWithPage(result.status, result.message, result.pageState));
@@ -611,12 +799,12 @@ function awaitCallback(server, state2, timeoutMs) {
         resolve({
           ok: true,
           code,
-          respond: async (status, message, pageState) => {
-            finalResponse = { status, message, pageState };
+          respond: async (status2, message, pageState) => {
+            finalResponse = { status: status2, message, pageState };
             phase = "terminal";
             const responders = acceptedResponders.splice(0);
             await Promise.all(
-              responders.map((acceptedRespond) => trackResponse(acceptedRespond(status, message, pageState)))
+              responders.map((acceptedRespond) => trackResponse(acceptedRespond(status2, message, pageState)))
             );
             await drainTrackedResponses();
           }
@@ -628,7 +816,7 @@ function awaitCallback(server, state2, timeoutMs) {
   });
 }
 function callbackResponder(response) {
-  return async (status, message, state2) => {
+  return async (status2, message, state2) => {
     if (response.writableEnded || response.destroyed) return;
     return new Promise((resolve) => {
       let flushTimer;
@@ -659,7 +847,7 @@ function callbackResponder(response) {
         }
         try {
           const html = loginPage(message, state2);
-          response.writeHead(status, {
+          response.writeHead(status2, {
             "cache-control": "no-store",
             connection: "close",
             "content-length": String(Buffer.byteLength(html)),
@@ -679,10 +867,10 @@ function callbackResponder(response) {
     });
   };
 }
-function respondEmpty(response, status) {
+function respondEmpty(response, status2) {
   response.once("error", () => void 0);
   try {
-    response.writeHead(status, {
+    response.writeHead(status2, {
       "cache-control": "no-store",
       connection: "close",
       "x-content-type-options": "nosniff"
@@ -696,7 +884,8 @@ async function exchangeCode(baseUrl, code, verifier, options) {
   try {
     const body = await bareClient(baseUrl, "", options).post("/api/v1/cli/token-exchange", { code, code_verifier: verifier });
     const token = body.data?.token;
-    if (typeof token === "string" && token !== "") return { ok: true, token };
+    const kind = typeof body.data?.kind === "string" ? body.data.kind : null;
+    if (typeof token === "string" && token !== "") return { ok: true, token, kind };
     return {
       ok: false,
       message: "the login-code exchange returned no token \u2014 aborting"
@@ -720,25 +909,40 @@ async function exchangeCode(baseUrl, code, verifier, options) {
 async function manualLogin(baseUrl, options) {
   const notify = options.notify ?? defaultNotify;
   const prompt = options.prompt ?? defaultPrompt;
+  if (options.org !== void 0) notify(`Choose organization ${options.org} on the login page; another organization's token will be refused.`);
   notify(
     `Open ${baseUrl}/cli/login in a browser, authorize, and paste the token below (an outside expert pastes the pxc_ credential minted in their expert view instead).`
   );
   const token = (await prompt()).trim();
   if (token === "") return { ok: false, message: "no token entered" };
-  return verifyAndStore(baseUrl, token, options);
+  return verifyAndStore(baseUrl, token, options, { minted: false, kind: null });
 }
-async function verifyAndStore(baseUrl, token, options) {
-  const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
+async function verifyAndStore(baseUrl, token, options, received) {
+  const defaultPath = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
+  const path = options.org === void 0 ? defaultPath : orgCredentialsPath(defaultPath, baseUrl, options.org);
   const client = bareClient(baseUrl, token, options);
   const expert = isExpertToken(token);
+  let kind = received.kind;
   try {
-    await client.get(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/teams");
+    if (expert) {
+      if (options.org !== void 0) return { ok: false, message: "cannot verify an outside expert credential against a repo org \u2014 nothing was stored" };
+      await client.get(EXPERT_ASSIGNMENTS_PATH);
+    } else {
+      const described = isLoginCredential(token) ? await describeSession(client) : null;
+      if (described !== null) kind = described.session.kind ?? kind;
+      if (options.org !== void 0 && (typeof described?.session.org?.["id"] !== "string" || described.session.org["id"].toLowerCase() !== options.org.toLowerCase())) {
+        const revoked = received.minted && await revokeSession(client, token);
+        return { ok: false, message: `the received token does not verify organization ${options.org} \u2014 nothing was stored` + (revoked ? ", and the token was revoked" : "") };
+      }
+      if (described === null) await client.get("/api/v1/teams");
+    }
   } catch (error) {
     if (error instanceof HttpError) {
       const lapsed = expert && error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : "";
+      const revoked = received.minted && await revokeSession(client, token);
       return {
         ok: false,
-        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored${lapsed}`
+        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored${revoked ? ", and the token was revoked" : ""}${lapsed}`
       };
     }
     if (error instanceof TransportError) {
@@ -754,11 +958,11 @@ async function verifyAndStore(baseUrl, token, options) {
   try {
     writeCredentials(path, baseUrl, token);
   } catch (error) {
-    await revokeSession(client, token);
+    if (received.minted) await revokeSession(client, token);
     const detail = error instanceof Error ? error.message : String(error);
     return {
       ok: false,
-      message: `could not store credentials at ${path}: ${detail}` + (expert ? " (the pxc_ credential is still valid: revoke it in your expert view)" : "")
+      message: `could not store credentials at ${path}: ${detail}` + (expert ? " (the pxc_ credential is still valid: revoke it in your expert view)" : received.minted ? "" : " (the pasted token was not revoked and stays valid)")
     };
   }
   let supersededNote = "";
@@ -768,12 +972,40 @@ async function verifyAndStore(baseUrl, token, options) {
       supersededNote = "The pxc_ credential stored before stays valid until it expires: revoke it in your expert view.\n";
     }
   }
+  const name = invokedName();
   return {
     ok: true,
-    json: { url: baseUrl, credentials: path },
-    human: (expert ? `Stored an outside expert's pxc_ credential for ${baseUrl} at ${path} (it lasts at most 30 days; revoke it in your expert view \u2014 harness logout only forgets it). Commands now act as the expert: only assignments, conditions and gate work until you log in again.
-` : `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; harness logout revokes it).
-`) + supersededNote
+    json: { url: baseUrl, credentials: path, kind },
+    human: (expert ? `Stored an outside expert's pxc_ credential for ${baseUrl} at ${path} (it lasts at most 30 days; revoke it in your expert view \u2014 ${name} logout only forgets it). Commands now act as the expert: only assignments, conditions and gate work until you log in again.
+` : `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; ${name} logout revokes it).
+`) + kindNote(kind) + supersededNote
+  };
+}
+function kindNote(kind) {
+  if (kind === "operator-cli") {
+    return "This credential is Operator-only (operator-cli): Operator commands work; issue, plan and gate commands are refused.\n";
+  }
+  if (kind === "harness-cli") return "This credential has full access (harness-cli).\n";
+  return "";
+}
+async function describeSession(client) {
+  try {
+    const { envelope, apiVersion } = await client.getVersioned(SESSION_PATH);
+    return { session: sessionOf(envelope.data), apiVersion };
+  } catch (error) {
+    if (error instanceof HttpError && (error.status === 404 || error.status === 405)) return null;
+    throw error;
+  }
+}
+function sessionOf(data) {
+  if (!isRecord3(data)) return NO_SESSION;
+  const text = (value) => typeof value === "string" ? value : null;
+  return {
+    kind: text(data["kind"]),
+    expires_at: text(data["expires_at"]),
+    scopes: Array.isArray(data["scopes"]) ? data["scopes"].filter((scope) => typeof scope === "string") : null,
+    user: isRecord3(data["user"]) ? data["user"] : null,
+    org: isRecord3(data["org"]) ? data["org"] : null
   };
 }
 async function revokeSession(client, token) {
@@ -814,8 +1046,18 @@ async function whoami(config, credentialSource) {
   const client = new Client(config);
   const expert = isExpertToken(config.token);
   let probe;
+  let session = null;
+  let serverVersion;
   try {
-    probe = (await client.get(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats")).data;
+    const described2 = isLoginCredential(config.token) ? await describeSession(client) : null;
+    if (described2 !== null) {
+      session = described2.session;
+      serverVersion = described2.apiVersion;
+    } else {
+      const answered = await client.getVersioned(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats");
+      probe = answered.envelope.data;
+      serverVersion = answered.apiVersion;
+    }
   } catch (error) {
     if (error instanceof HttpError) {
       return {
@@ -835,7 +1077,7 @@ async function whoami(config, credentialSource) {
       };
     }
   }
-  const serverVersion = await client.serverVersion().catch(() => "unknown");
+  serverVersion ??= "unknown";
   const hostSourceLabels = {
     env: "HARNESS_API_URL",
     "repo-config": ".harness-cli/config.json",
@@ -846,6 +1088,7 @@ async function whoami(config, credentialSource) {
   const expertLines = seat === null ? "" : `Expert:      ${expertSummary(seat)}
 Reaches:     its own assignments and the gates it owns on them (assignments, conditions, gate)
 `;
+  const described = session ?? NO_SESSION;
   return {
     ok: true,
     json: {
@@ -854,21 +1097,55 @@ Reaches:     its own assignments and the gates it owns on them (assignments, con
       verified: true,
       server_version: serverVersion,
       host_source: config.hostSource,
+      kind: described.kind,
+      expires_at: described.expires_at,
+      scopes: described.scopes,
+      user: described.user,
+      org: described.org,
       expert: seat
     },
     human: `Host:        ${config.baseUrl}${via}
-Credential:  ${credentialSource}${seat === null ? "" : ", an outside expert's pxc_ credential"}
-` + expertLines + `Verified:    ok (server API ${serverVersion})
+Credential:  ${credentialSource}${seat === null ? "" : ", an outside expert's pxc_ credential"}${kindLabel(described.kind)}
+` + sessionLines(described) + expertLines + `Verified:    ok (server API ${serverVersion})
 `
   };
 }
+function kindLabel(kind) {
+  if (kind === null) return "";
+  if (kind === "harness-cli") return ", harness-cli (full access)";
+  if (kind === "operator-cli") return ", operator-cli (Operator only)";
+  return `, ${clean(kind)}`;
+}
+function sessionLines(session) {
+  let lines = "";
+  const user2 = session.user;
+  if (user2 !== null) {
+    const name = clean(user2["name"]);
+    const email = clean(user2["email"]);
+    lines += `User:        ${name === "" ? email : email === "" ? name : `${name} <${email}>`}
+`;
+  }
+  const org = session.org;
+  if (org !== null) {
+    const name = clean(org["name"]);
+    const slug = clean(org["slug"]);
+    lines += `Org:         ${slug === "" || slug === name ? name : `${name} (${slug})`}
+`;
+  }
+  if (session.expires_at !== null) lines += `Expires:     ${clean(session.expires_at)}
+`;
+  if (session.kind === "operator-cli") {
+    lines += "Reaches:     Operator commands only; issue, plan and gate commands are refused\n";
+  }
+  return lines;
+}
 function expertSeat(data) {
-  if (!isRecord2(data) || !isRecord2(data["expert"])) return null;
-  const plan2 = isRecord2(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
-  const steps = Array.isArray(data["assignments"]) ? data["assignments"].filter(isRecord2).length : 0;
+  if (!isRecord3(data) || !isRecord3(data["expert"])) return null;
+  const plan2 = isRecord3(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
+  const steps = Array.isArray(data["assignments"]) ? data["assignments"].filter(isRecord3).length : 0;
   return { id: data["expert"]["id"], role: data["expert"]["role"] ?? null, plan: plan2, assigned_steps: steps };
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function bareClient(baseUrl, token, options) {
@@ -883,7 +1160,7 @@ function bareClient(baseUrl, token, options) {
   return new Client(config);
 }
 function defaultNotify(line) {
-  process.stderr.write(line + "\n");
+  process.stderr.write(named(line + "\n"));
 }
 function defaultPrompt() {
   const readline = createInterface({
@@ -914,57 +1191,6 @@ function guardBrokenPipes(streams = [process.stdout, process.stderr]) {
   }
 }
 
-// src/invocation.ts
-import { basename } from "path";
-var OPERATOR_PACKAGE = "@allocator-one/operator";
-function invokedName(argv1 = process.argv[1], packageName = CLI_PACKAGE) {
-  const typed = basename(argv1 ?? "").replace(/\.[cm]?js$/i, "").toLowerCase();
-  if (typed === "operator" || typed === "harness") return typed;
-  return packageName === OPERATOR_PACKAGE ? "operator" : "harness";
-}
-var OPERATOR_COMMANDS = [
-  "run",
-  "jobs",
-  "job",
-  "watch",
-  "steer",
-  "cancel",
-  "pause",
-  "continue",
-  "procedure",
-  "plan",
-  "gate",
-  "conditions",
-  "assignments",
-  "tools",
-  "tool",
-  "skills",
-  "mcp"
-];
-var GENERAL_COMMANDS = [
-  "login",
-  "logout",
-  "whoami",
-  "version",
-  "keys"
-];
-var OPERATOR_HEADING = "Operator:";
-var ISSUES_HEADING = "Issues:";
-var GENERAL_HEADING = "General:";
-function layoutOperatorHelp(program2) {
-  const rank = (name) => {
-    const operator = OPERATOR_COMMANDS.indexOf(name);
-    if (operator !== -1) return operator;
-    return GENERAL_COMMANDS.includes(name) ? 2 * OPERATOR_COMMANDS.length : OPERATOR_COMMANDS.length;
-  };
-  const heading = (name) => OPERATOR_COMMANDS.includes(name) ? OPERATOR_HEADING : GENERAL_COMMANDS.includes(name) ? GENERAL_HEADING : ISSUES_HEADING;
-  for (const command of program2.commands) command.helpGroup(heading(command.name()));
-  program2.commands.sort(
-    (left, right) => rank(left.name()) - rank(right.name())
-  );
-  program2.commandsGroup(GENERAL_HEADING).helpCommand(true);
-}
-
 // src/core/upgrade.ts
 import { spawn as spawn2, spawnSync } from "child_process";
 import {
@@ -980,7 +1206,7 @@ import {
   statSync,
   writeFileSync
 } from "fs";
-import { basename as basename2, dirname, join as join2, parse, sep } from "path";
+import { basename, dirname, join as join2, parse, sep } from "path";
 import { fileURLToPath } from "url";
 var PACKAGE_NAME = "@allocator-one/harness-cli";
 var PACKAGE_NAMES = [PACKAGE_NAME, OPERATOR_PACKAGE];
@@ -1053,7 +1279,7 @@ function enclosingNodeModules(packageRoot) {
   let dir = dirname(packageRoot);
   const { root } = parse(dir);
   for (; ; ) {
-    if (basename2(dir) === "node_modules") return dir;
+    if (basename(dir) === "node_modules") return dir;
     if (dir === root) return null;
     dir = dirname(dir);
   }
@@ -1299,8 +1525,8 @@ function npmInstallGlobal(install, stillHeld) {
     };
   }
   process.stderr.write(
-    `harness: upgrading ${install.packageName ?? PACKAGE_NAME} \u2026
-`
+    named(`harness: upgrading ${install.packageName ?? PACKAGE_NAME} \u2026
+`)
   );
   const args = [
     "install",
@@ -1368,8 +1594,8 @@ function reexecSelf(env, argv2) {
   });
   if (result.error !== void 0) {
     process.stderr.write(
-      `harness: upgraded, but re-running failed: ${result.error.message}
-`
+      named(`harness: upgraded, but re-running failed: ${result.error.message}
+`)
     );
     return 1;
   }
@@ -1473,11 +1699,14 @@ function exitWith(code) {
 guardBrokenPipes();
 var program = new Command();
 var invokedAs = invokedName();
+function writeStderr(text) {
+  return process.stderr.write(named(text, invokedAs));
+}
 program.name(invokedAs).description(
   invokedAs === "operator" ? "drive Operator from the terminal and any agent, with Harness issue tracking alongside (harness.infra.one)" : "issue tracking for humans and agents (harness.infra.one)"
 ).exitOverride().configureOutput({
-  writeOut: (text) => process.stdout.write(text),
-  writeErr: (text) => process.stderr.write(text)
+  writeOut: (text) => process.stdout.write(named(text, invokedAs)),
+  writeErr: (text) => writeStderr(text)
 });
 function integer(value) {
   if (!/^\d+$/.test(value))
@@ -1518,59 +1747,67 @@ function interactive() {
   const ci = process.env["CI"];
   return process.stdout.isTTY === true && (ci === void 0 || ci === "");
 }
-async function withConfig(jsonFlag, mutating, run) {
+function canConfirmRepoLogin() {
+  return process.stdin.isTTY === true && process.stderr.isTTY === true;
+}
+async function confirmRepoLogin(baseUrl, source, path) {
+  if (source !== "repo-config" || isHostTrusted(baseUrl)) return true;
+  const answer = await promptLine(
+    `This repo's config (${path ?? ".harness-cli/config.json"}) targets ${baseUrl} \u2014 log in there? [y/N] `
+  );
+  if (answer.trim().toLowerCase() !== "y") {
+    writeStderr(`harness: not logging in to ${baseUrl} \u2014 set HARNESS_API_URL to override the repo config
+`);
+    return false;
+  }
+  trustHost(baseUrl);
+  return true;
+}
+async function withConfig(jsonFlag, mutating, run2) {
   const resolved = resolveConfig();
-  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
+  for (const warning of resolved.warnings) writeStderr(warning + "\n");
   if (resolved.kind === "error") {
-    process.stderr.write(`harness: ${resolved.message}
+    writeStderr(`harness: ${resolved.message}
 `);
     return exitWith(2);
   }
   if (resolved.kind === "needs-login") {
     if (!interactive()) {
-      process.stderr.write(loginHelp(resolved.baseUrl));
+      writeStderr(loginHelp(resolved.baseUrl));
+      if (resolved.org !== void 0) writeStderr(`Choose organization ${resolved.org} when logging in.
+`);
       return exitWith(2);
     }
-    if (resolved.hostSource === "repo-config" && !isHostTrusted(resolved.baseUrl)) {
-      const answer = await promptLine(
-        `This repo's config (${resolved.repoConfigPath ?? ".harness-cli/config.json"}) targets ${resolved.baseUrl} \u2014 log in there? [y/N] `
-      );
-      if (answer.trim().toLowerCase() !== "y") {
-        process.stderr.write(
-          `harness: not logging in to ${resolved.baseUrl} \u2014 set HARNESS_API_URL to override the repo config
-`
-        );
-        return exitWith(2);
-      }
-      trustHost(resolved.baseUrl);
+    if (!await confirmRepoLogin(resolved.baseUrl, resolved.hostSource, resolved.repoConfigPath)) {
+      return exitWith(2);
     }
-    const loginResult = await login(resolved.baseUrl, {});
+    const loginResult = await login(resolved.baseUrl, resolved.org === void 0 ? {} : { org: resolved.org });
     if (!loginResult.ok) {
-      process.stderr.write(`harness: ${clean(loginResult.message)}
+      writeStderr(`harness: ${clean(loginResult.message)}
 `);
       return exitWith(1);
     }
-    process.stderr.write(loginResult.human);
+    writeStderr(loginResult.human);
     const again = resolveConfig();
     if (again.kind !== "ok") {
-      process.stderr.write(
+      writeStderr(
         `harness: still not signed in to ${resolved.baseUrl} after logging in
 `
       );
       return exitWith(1);
     }
-    return execute(again.config, jsonFlag, mutating, run);
+    return execute(again.config, jsonFlag, mutating, run2);
   }
-  return execute(resolved.config, jsonFlag, mutating, run);
+  return execute(resolved.config, jsonFlag, mutating, run2);
 }
-async function execute(config, jsonFlag, mutating, run) {
+async function execute(config, jsonFlag, mutating, run2) {
   const client = new Client(config);
   const hostNotice = mutating ? `\u2192 ${config.baseUrl}
 ` : "";
   try {
-    const output = await run({ client, config });
-    process.stderr.write(hostNotice);
-    if (output.notice !== void 0) process.stderr.write(output.notice);
+    const output = await run2({ client, config });
+    writeStderr(hostNotice);
+    if (output.notice !== void 0) writeStderr(output.notice);
     process.stdout.write(jsonFlag ? json(output.json) : output.human);
     return exitWith(output.exitCode ?? (output.partial === true ? 1 : 0));
   } catch (error) {
@@ -1579,16 +1816,16 @@ async function execute(config, jsonFlag, mutating, run) {
 }
 async function fail(error, hostNotice) {
   if (error instanceof UsageError) {
-    process.stderr.write(error.message + "\n");
+    writeStderr(error.message + "\n");
     return exitWith(2);
   }
   if (error instanceof LocalError) {
-    process.stderr.write(`harness: ${clean(error.message)}
+    writeStderr(`harness: ${clean(error.message)}
 `);
     return exitWith(1);
   }
   if (error instanceof TransportError) {
-    process.stderr.write(
+    writeStderr(
       hostNotice + `harness: cannot reach the API: ${clean(error.message)}
 `
     );
@@ -1598,21 +1835,21 @@ async function fail(error, hostNotice) {
     const healed = selfHeal();
     if (healed.kind === "upgraded") return exitWith(healed.code);
     const why = healed.kind === "failed" ? ` (tried to upgrade: ${clean(healed.reason)})` : "";
-    process.stderr.write(
+    writeStderr(
       hostNotice + `harness: ${clean(error.message)} (HTTP 426)${why}
 `
     );
     return exitWith(1);
   }
   if (error instanceof HttpError) {
-    process.stderr.write(
+    writeStderr(
       hostNotice + `harness: ${clean(error.message)} (HTTP ${error.status})${errorDetails(error.body)}
 `
     );
     return exitWith(1);
   }
   if (error instanceof CommandError) {
-    process.stderr.write(hostNotice + `harness: ${clean(error.message)}
+    writeStderr(hostNotice + `harness: ${clean(error.message)}
 `);
     return exitWith(1);
   }
@@ -1880,32 +2117,37 @@ plan.command("create").description("create a plan from a JSON or YAML file (the
     return planCreate(ctx, readPlanFile(opts.file), { ...opts, team: team2 });
   });
 });
-plan.command("show").description("a plan's status, budgets, revision, steps, edges and wait conditions").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+plan.command("list").description("a team's plans, newest first: root, status, held, revision and title").option("--team <key>", "the team whose issues root the plans (or HARNESS_TEAM)").option("--status <status>", PLAN_STATUSES.join(" | ")).option("--limit <n>", `maximum plans (default 50, at most ${PLAN_LIST_MAX_LIMIT}; there are no pages)`, integer).option("--json", "emit JSON").action(async (opts) => {
+  requirePlanListArgs(opts);
+  await withConfig(opts.json === true, false, (ctx) => planList(ctx, opts));
+});
+var PLAN_ARGUMENT = "the plan's id, or its root issue's identifier (e.g. FR-1)";
+plan.command("show").description("a plan's status, budgets, revision, steps, edges and wait conditions").argument("[plan]", PLAN_ARGUMENT).option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, false, (ctx) => {
-    if (id === void 0) throw new UsageError("usage: harness plan show <plan-id>");
+    if (id === void 0) throw new UsageError("usage: harness plan show <plan-id-or-root>");
     return planShow(ctx, id);
   });
 });
-plan.command("edit").description("change step executors and keys, and budgets, from a JSON or YAML file").argument("[id]").option("--file <path>", 'the edit: .json is JSON, anything else YAML ("-" for stdin)').option("--json", "emit JSON").action(async (id, opts) => {
+plan.command("edit").description("change step executors and keys, and budgets, from a JSON or YAML file").argument("[plan]", PLAN_ARGUMENT).option("--file <path>", 'the edit: .json is JSON, anything else YAML ("-" for stdin)').option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => {
     if (id === void 0 || opts.file === void 0) {
-      throw new UsageError("usage: harness plan edit <plan-id> --file <edits.json|edits.yaml>");
+      throw new UsageError("usage: harness plan edit <plan-id-or-root> --file <edits.json|edits.yaml>");
     }
-    requirePlanId(id);
+    requirePlanRef(id);
     return planEdit(ctx, id, readPlanFile(opts.file));
   });
 });
-plan.command("release").description("release a plan as yourself: freeze its next revision and let its ready steps run").argument("[id]").option("--collaborator <who>", "a person of this organization (id or email) for the plan room (repeatable)", collect, []).option("--retry-budget <n>", "retries per failed Operator step", integer).option("--spend-budget-cents <n>", "the plan's spend budget; needed to release Operator steps", integer).option("--json", "emit JSON").action(
+plan.command("release").description("release a plan as yourself: freeze its next revision and let its ready steps run").argument("[plan]", PLAN_ARGUMENT).option("--collaborator <who>", "a person of this organization (id or email) for the plan room (repeatable)", collect, []).option("--retry-budget <n>", "retries per failed Operator step", integer).option("--spend-budget-cents <n>", "the plan's spend budget; needed to release Operator steps", integer).option("--json", "emit JSON").action(
   async (id, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
-      if (id === void 0) throw new UsageError("usage: harness plan release <plan-id>");
+      if (id === void 0) throw new UsageError("usage: harness plan release <plan-id-or-root>");
       return planRelease(ctx, id, { ...opts, collaborators: opts.collaborator });
     });
   }
 );
-plan.command("hold").description("pause every step of a plan until it is released again").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+plan.command("hold").description("pause every step of a plan until it is released again").argument("[plan]", PLAN_ARGUMENT).option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => {
-    if (id === void 0) throw new UsageError("usage: harness plan hold <plan-id>");
+    if (id === void 0) throw new UsageError("usage: harness plan hold <plan-id-or-root>");
     return planHold(ctx, id);
   });
 });
@@ -2040,6 +2282,32 @@ ${NOT_RETRIED}`
   await withConfig(opts.json === true, true, (ctx) => jobPause(ctx, id));
 });
 var NOT_IDEMPOTENT = "Not idempotent: it is sent once and never retried, not after a timeout or a 5xx either. Exit 3 means the request never reached the server, so nothing changed. When it may have, the outcome is unknown: it exits 1 and says so. Then check";
+program.command("run").description("start an Operator job from an outcome, as Run as job does in the app; --watch follows it").argument("[outcome...]").option("--budget <usd>", "US dollars the organization's monthly Operator budget must still have (admins only)", once("--budget")).option("--skill <name>", "run one of the organization's Operator skills, by invocation name (/name)", once("--skill")).option("--watch", "follow the job like `watch --through-waits`; it never approves").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Starts a job for you in a new org chat of yours, under your own current rights.
+Prints the job id, its state and its workbench link, and the approval link
+while a change set waits for approval. Approving happens in the app; the CLI
+never approves. You can start 30 jobs an hour. ${NOT_IDEMPOTENT} \`jobs --mine\` for the new job before running it again.
+
+With --watch the job is followed until it completes (exit 0) or fails or is
+cancelled (exit ${EXIT_JOB_ENDED}). When it waits for a person, the approval link is printed and the
+watch keeps waiting; Ctrl-C stops it (exit ${EXIT_INTERRUPTED}) and stderr says how to resume.
+`
+).action(async (words, opts) => {
+  const request = prepareRun(words.join(" "), { budget: opts.budget, skill: opts.skill });
+  const json2 = opts.json === true;
+  await withConfig(
+    json2,
+    true,
+    (ctx) => run(ctx, request, {
+      watch: opts.watch === true,
+      json: json2,
+      onLine: (line) => process.stdout.write(line),
+      signal: opts.watch === true ? watchStopSignal() : void 0
+    })
+  );
+});
 function once(flag) {
   return (value, previous) => {
     if (previous !== void 0) throw new InvalidArgumentError(`${flag} given twice \u2014 pass it once`);
@@ -2275,15 +2543,15 @@ link.command("rm").argument("[issue]").argument("[id-or-url]").option("--json",
     });
   }
 );
-var label = program.command("label").description("labels");
-label.command("list").option("--json", "emit JSON").action(async (opts) => {
+var label2 = program.command("label").description("labels");
+label2.command("list").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
     (ctx) => labelList(ctx)
   );
 });
-label.command("create").argument("[name]").option("--color <color>", "label color").option("--json", "emit JSON").action(
+label2.command("create").argument("[name]").option("--color <color>", "label color").option("--json", "emit JSON").action(
   async (name, opts) => {
     await withConfig(
       opts.json === true,
@@ -2292,10 +2560,10 @@ label.command("create").argument("[name]").option("--color <color>", "label colo
     );
   }
 );
-label.command("update").description("rename or recolor a label").argument("[id]").option("--name <name>", "new name").option("--color <color>", "swatch name (red, blue, \u2026) or a hex code").option("--json", "emit JSON").action(async (id, opts) => {
+label2.command("update").description("rename or recolor a label").argument("[id]").option("--name <name>", "new name").option("--color <color>", "swatch name (red, blue, \u2026) or a hex code").option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => labelUpdate(ctx, id, opts));
 });
-label.command("delete").description("delete a label (refused while issues carry it)").argument("[id]").option("--yes", "confirm the deletion").option("--json", "emit JSON").action(async (id, opts) => {
+label2.command("delete").description("delete a label (refused while issues carry it)").argument("[id]").option("--yes", "confirm the deletion").option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => labelDelete(ctx, id, opts));
 });
 var team = program.command("team").description("teams");
@@ -2406,7 +2674,7 @@ program.command("skills").description("the organization's skills assigned to Ope
   await withConfig(opts.json === true, false, (ctx) => skillsList(ctx));
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-O7CX2ZCC.js");
+  const { startMcpServer } = await import("./server-F6YRKNC2.js");
   await startMcpServer(invokedAs);
 });
 var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
@@ -2428,6 +2696,17 @@ keys.command("exec").description(
     (ctx) => exec(ctx, { command, override: opts.override === true, only })
   );
 });
+var review = program.command("review").description("a pull request's enforced Review Council gate, and a retry of its latest attempt");
+review.command("status").description("the gate's enforced and advisory status, and a failed latest attempt with what comes next").argument("<pr>", "owner/repo#<pr>, the pull request URL, or <pr> with --repo or this checkout's origin").option("--repo <owner/repo>", "the repository a bare pull request number belongs to").option("--json", "emit JSON").action(async (pr, opts) => {
+  const ref = parsePullRequest(pr, opts.repo);
+  await withConfig(opts.json === true, false, (ctx) => status(ctx, ref));
+});
+review.command("retry").description(
+  "retry the latest gate attempt of the pull request's current head (needs reviews:write); the head, check and attempt are read from the gate status"
+).argument("<pr>", "owner/repo#<pr>, the pull request URL, or <pr> with --repo or this checkout's origin").option("--repo <owner/repo>", "the repository a bare pull request number belongs to").option("--reason <text>", "why the attempt is retried, recorded with it").option("--json", "emit JSON").action(async (pr, opts) => {
+  const ref = parsePullRequest(pr, opts.repo);
+  await withConfig(opts.json === true, true, (ctx) => retry(ctx, ref, opts.reason));
+});
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(
   "--timeout <ms>",
   "how long to wait for the browser callback",
@@ -2436,34 +2715,52 @@ program.command("login").description("sign in via the browser (infra.one session
   async (opts) => {
     const repoLookup = findRepoConfig();
     for (const warning of repoLookup.warnings)
-      process.stderr.write(warning + "\n");
+      writeStderr(warning + "\n");
     const repoUrl = repoLookup.config?.url;
-    const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
+    const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? (repoLookup.config?.org === void 0 ? storedLoginUrl() : void 0) ?? DEFAULT_BASE_URL;
     if (url === repoUrl && opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0) {
-      process.stderr.write(
+      writeStderr(
         `harness: host ${url} comes from ${repoLookup.config?.path}
 `
       );
     }
+    const repoSelected = opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0 && repoUrl !== void 0;
+    if (repoSelected && !isHostTrusted(url)) {
+      if (!canConfirmRepoLogin()) {
+        writeStderr("harness: cannot confirm a repo-selected host without a terminal \u2014 pass --url explicitly\n");
+        return exitWith(2);
+      }
+      if (!await confirmRepoLogin(url, "repo-config", repoLookup.config?.path)) return exitWith(2);
+    }
     const options = { noBrowser: !opts.browser };
+    if (repoLookup.config?.org !== void 0) options.org = repoLookup.config.org;
     if (opts.timeout !== void 0) options.timeoutMs = opts.timeout;
     await finishAuth(await login(url, options), opts.json === true);
   }
 );
 program.command("logout").description("revoke and forget the stored login").option("--json", "emit JSON").action(async (opts) => {
-  await finishAuth(await logout(), opts.json === true);
+  const selected = resolveConfig({ ...process.env, HARNESS_API_TOKEN: void 0 });
+  if (selected.kind === "error") {
+    writeStderr(`harness: ${selected.message}
+`);
+    return exitWith(2);
+  }
+  const path = selected.kind === "ok" ? selected.config.credentialsPath : selected.credentialsPath;
+  await finishAuth(await logout(path === void 0 ? {} : { credentialsPath: path }), opts.json === true);
 });
 program.command("whoami").description("show the resolved host and credential source").option("--json", "emit JSON").action(async (opts) => {
   const resolved = resolveConfig();
   for (const warning of resolved.warnings)
-    process.stderr.write(warning + "\n");
+    writeStderr(warning + "\n");
   if (resolved.kind === "error") {
-    process.stderr.write(`harness: ${resolved.message}
+    writeStderr(`harness: ${resolved.message}
 `);
     return exitWith(2);
   }
   if (resolved.kind === "needs-login") {
-    process.stderr.write(loginHelp(resolved.baseUrl));
+    writeStderr(loginHelp(resolved.baseUrl));
+    if (resolved.org !== void 0) writeStderr(`Choose organization ${resolved.org} when logging in.
+`);
     return exitWith(2);
   }
   const source = blankToUndefined(process.env["HARNESS_API_TOKEN"]) !== void 0 ? "environment" : "stored login";
@@ -2472,7 +2769,7 @@ program.command("whoami").description("show the resolved host and credential sou
     result = await whoami(resolved.config, source);
   } catch (error) {
     if (!(error instanceof TransportError)) throw error;
-    process.stderr.write(`harness: cannot reach the API: ${clean(error.message)}
+    writeStderr(`harness: cannot reach the API: ${clean(error.message)}
 `);
     return exitWith(3);
   }
@@ -2489,7 +2786,7 @@ async function finishAuth(result, json2) {
     process.stdout.write(json2 ? json(result.json) : result.human);
     return exitWith(0);
   }
-  process.stderr.write(`harness: ${clean(result.message)}
+  writeStderr(`harness: ${clean(result.message)}
 `);
   return exitWith(1);
 }
@@ -2501,7 +2798,7 @@ if (argv[2] === UPDATE_CHECK_COMMAND) {
 }
 try {
   const notice = updateCheck();
-  if (notice !== null) process.stderr.write(notice);
+  if (notice !== null) writeStderr(notice);
 } catch {
 }
 if (invokedAs === "operator") layoutOperatorHelp(program);
@@ -2513,7 +2810,7 @@ try {
   await program.parseAsync(argv);
 } catch (error) {
   if (error instanceof UsageError) {
-    process.stderr.write(error.message + "\n");
+    writeStderr(error.message + "\n");
     await exitWith(2);
   }
   if (error instanceof CommanderError) {