@allocator-one/harness-cli 1.15.0 → 1.16.0

package/dist/{login-page-UVUKFFTT.js → login-page-KGEJFFXR.js}

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+import {
+  invokedName,
+  named
+} from "./chunk-FQWV5MIC.js";
 
 // src/core/login-page.ts
 import { createHash } from "crypto";
@@ -157,8 +161,10 @@ var TERMINAL_SCRIPT = `(function () {
 
   void play();
 })();`;
-var NORMALIZED_TERMINAL_SCRIPT = TERMINAL_SCRIPT.replace(/\r\n/g, "\n");
-var TERMINAL_SCRIPT_HASH = createHash("sha256").update(NORMALIZED_TERMINAL_SCRIPT).digest("base64");
+function terminalScript(name) {
+  const script = named(TERMINAL_SCRIPT, name).replace(/\r\n/g, "\n");
+  return { script, hash: createHash("sha256").update(script).digest("base64") };
+}
 var PRESENTATION = {
   success: {
     eyebrow: "Login complete",
@@ -176,7 +182,8 @@ var PRESENTATION = {
 function escapeHtml(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-function loginPage(message, state) {
+function loginPage(message, state, name = invokedName()) {
+  const { script, hash } = terminalScript(name);
   const resolvedState = Object.hasOwn(PRESENTATION, state) ? state : "waiting";
   const { eyebrow, heading } = PRESENTATION[resolvedState];
   const safeEyebrow = escapeHtml(eyebrow);
@@ -187,7 +194,7 @@ function loginPage(message, state) {
 <html lang="en"><head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src data:; img-src data:; script-src 'sha256-${TERMINAL_SCRIPT_HASH}'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src data:; img-src data:; script-src 'sha256-${hash}'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
 <meta name="color-scheme" content="light">
 <title>${safeHeading} \xB7 Harness</title>
 <style>
@@ -281,7 +288,7 @@ function loginPage(message, state) {
         <div class="terminal-stream" data-terminal-stream aria-hidden="true"></div>
       </div>
     </div>
-    <script>${NORMALIZED_TERMINAL_SCRIPT}</script>` : ""}
+    <script>${script}</script>` : ""}
   </aside>
 </main>
 </body></html>

package/dist/{server-O7CX2ZCC.js → server-F6YRKNC2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   ACTIVITY_MAX_LIMIT,
-  CLI_VERSION,
+  BUDGET_MAX_DOLLARS,
   CONDITION_KINDS,
   Client,
   GATE_OWNER_ROLES,
@@ -11,7 +11,11 @@ import {
   JOB_STATES,
   JOB_STATUS_ALIASES,
   MAX_IDEMPOTENCY_KEY_BYTES,
+  MCP_SURFACE,
+  OUTCOME_MAX_CHARACTERS,
   PLAN_EXECUTORS,
+  PLAN_LIST_MAX_LIMIT,
+  PLAN_STATUSES,
   RELATION_CREATE_TYPES,
   RELATION_UPDATE_TYPES,
   STEER_MAX_CHARACTERS,
@@ -59,8 +63,10 @@ import {
   planCreate,
   planEdit,
   planHold,
+  planList,
   planRelease,
   planShow,
+  prepareRun,
   procedureRun,
   procedureSave,
   procedureShow,
@@ -77,6 +83,7 @@ import {
   search,
   show,
   skillsList,
+  startRun,
   stateAdd,
   stateDelete,
   stateOrder,
@@ -92,7 +99,12 @@ import {
   upload,
   userList,
   workflowStates
-} from "./chunk-I2S2JVCQ.js";
+} from "./chunk-GVTZKAXC.js";
+import {
+  CLI_VERSION,
+  invokedName,
+  named
+} from "./chunk-FQWV5MIC.js";
 
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -102,11 +114,11 @@ var NeedsLoginError = class extends Error {
 };
 function context() {
   const resolved = resolveConfig();
-  for (const warning of resolved.warnings) process.stderr.write(warning + "\n");
+  for (const warning of resolved.warnings) process.stderr.write(named(warning + "\n"));
   if (resolved.kind === "error") throw new NeedsLoginError(resolved.message);
   if (resolved.kind === "needs-login") {
     throw new NeedsLoginError(
-      `Not signed in to ${resolved.baseUrl}. Run \`harness login\` in a terminal (or set HARNESS_API_TOKEN for headless use) \u2014 the MCP server never opens a browser itself.`
+      `Not signed in to ${resolved.baseUrl}${resolved.org === void 0 ? "" : ` for organization ${resolved.org}`}. Run \`${invokedName()} login\` in a terminal (or set HARNESS_API_TOKEN for headless use) \u2014 the MCP server never opens a browser itself.`
     );
   }
   return { client: new Client(resolved.config), config: resolved.config };
@@ -122,7 +134,7 @@ async function run(work) {
     const output = await work(ctx);
     const content = [{ type: "text", text: JSON.stringify(output.json) }];
     if (output.notice !== void 0 && output.notice !== "") {
-      content.push({ type: "text", text: output.notice.trimEnd() });
+      content.push({ type: "text", text: named(output.notice.trimEnd()) });
     }
     if (output.partial === true) {
       content.push({ type: "text", text: "partial failure \u2014 inspect the JSON entries for per-item errors" });
@@ -133,10 +145,10 @@ async function run(work) {
     const error = explainExpertRefusal(caught, token);
     if (error instanceof NeedsLoginError) return toolError(error.message);
     if (error instanceof HttpError) {
-      return toolError(`${error.message} (HTTP ${error.status})${errorDetails(error.body)}`);
+      return toolError(named(`${error.message} (HTTP ${error.status})${errorDetails(error.body)}`));
     }
     if (error instanceof TransportError) return toolError(`cannot reach the API: ${error.message}`);
-    if (error instanceof Error) return toolError(error.message);
+    if (error instanceof Error) return toolError(named(error.message));
     throw error;
   }
 }
@@ -187,9 +199,11 @@ var planDocument = z.object({
   parent: z.string().optional().describe("an existing issue to file the root under, e.g. IO-12"),
   retry_budget: z.number().int().min(0).optional().describe("retries per failed Operator step (default 2)"),
   spend_budget_cents: z.number().int().min(0).nullable().optional().describe("needed to release a plan with Operator steps"),
-  steps: z.array(planStep).min(1).describe("at most 99 steps besides the root")
+  steps: z.array(planStep).min(1).describe(
+    "with the root, at most the organization's max plan steps (default 1000, at most 2000), and at most 100 Operator steps"
+  )
 }).passthrough();
-var planId = z.string().uuid().describe("plan UUID, from plan_create");
+var planId = z.string().describe("the plan's UUID, or its root issue's identifier (e.g. FR-1, any casing): plan_list or issue_show's plan.root");
 var planStepEdit = z.object({
   step: z.string().optional().describe("the step's key; give this or issue"),
   issue: z.string().optional().describe("the step's issue identifier; give this or step"),
@@ -258,6 +272,40 @@ var OPERATOR_CONTROL_TOOLS = [
     handler: (ctx, args) => jobPause(ctx, args["id"])
   }
 ];
+var OPERATOR_RUN_TOOLS = [
+  {
+    name: "job_start",
+    description: `Start an Operator job from an outcome, as Run as job does in Chat Mode in the app: the request is posted, attributed to the caller, in a new organization chat of theirs, and Operator takes it from there under the caller's own current rights. Returns job_id, state, workbench_url and, when a change set already awaits approval, approval_url. Approval happens in the app: give a person the approval_url; this tool never approves anything, and no tool does. Each call starts another job, so never call it again to "retry": not after a timeout, a dropped connection or a 5xx either. An "Outcome unknown" error means a job may have been started; look for it with jobs_list (mine) before calling again. Only the organization's admins may pass a budget. Follow the job with job_show.`,
+    readOnly: false,
+    destructive: false,
+    idempotent: false,
+    shape: {
+      outcome: z.string().describe(
+        `what the job should achieve, in plain language: 1 to ${OUTCOME_MAX_CHARACTERS} characters once trimmed`
+      ),
+      budget: z.number().positive().max(BUDGET_MAX_DOLLARS).optional().describe(
+        `the job's budget in US dollars, at most two decimals, up to ${BUDGET_MAX_DOLLARS}; only the organization's admins may pass one`
+      ),
+      skill: z.string().optional().describe("an Operator skill's invocation name, like /summarize-lps (skills_list names them)")
+    },
+    handler: async (ctx, args) => {
+      const request = prepareRun(args["outcome"], {
+        budget: args["budget"] === void 0 ? void 0 : String(args["budget"]),
+        skill: args["skill"]
+      }, MCP_SURFACE);
+      const job = await startRun(ctx, request, MCP_SURFACE);
+      return {
+        json: {
+          job_id: job.job_id,
+          state: job.state,
+          workbench_url: job.workbench_url,
+          ...job.approval_url === null ? {} : { approval_url: job.approval_url }
+        },
+        human: `Started Operator job ${job.job_id}.`
+      };
+    }
+  }
+];
 var NOT_IDEMPOTENT = 'Not idempotent: never retry it automatically, not after a timeout or a 5xx either. An "Outcome unknown" error may have landed and says what to check before calling again; only "cannot reach the API" means the request never reached the server, so nothing changed.';
 var OPERATOR_LIFECYCLE_TOOLS = [
   {
@@ -363,7 +411,7 @@ var TOOLS = [
   },
   {
     name: "issue_show",
-    description: "Full issue detail: fields, relations, children, comments. blockers gives each unresolved blocker's state_type and archived flag: only a completed blocker resolves, so a cancelled or archived one still blocks. waiting_on_condition and conditions say which wait conditions (not_before, gate, event) still hold it; tick a gate with gate_set. images=true downloads attached images to the local cache and includes their paths as local_images.",
+    description: "Full issue detail: fields, relations, children, comments. blockers gives each unresolved blocker's state_type and archived flag: only a completed blocker resolves, so a cancelled or archived one still blocks. waiting_on_condition and conditions say which wait conditions (not_before, gate, event) still hold it; tick a gate with gate_set. plan is the plan governing the issue (the nearest rooted at it or an ancestor), or null: its id, root identifier (which the plan tools take), status, held, the revision number it runs, in_revision (whether that revision lists the issue: an Operator step outside it waits for plan_release, a person's step does not) and the issue's executor. images=true downloads attached images to the local cache and includes their paths as local_images.",
     readOnly: true,
     shape: { id: identifier, images: z.boolean().optional() },
     handler: (ctx, args) => show(ctx, args["id"], { images: args["images"] === true })
@@ -437,7 +485,7 @@ var TOOLS = [
   },
   {
     name: "issue_claim",
-    description: "Atomically claim an issue: assigns it and moves it to the team's first started state. A conflict names its reason: someone else holds it, or it is not claimable (e.g. agent_step, waiting_on_condition).",
+    description: "Atomically claim an issue: assigns it and moves it to the team's first started state. A conflict names its reason: someone else holds it, or it is not claimable (e.g. agent_step, waiting_on_condition). A refusal that comes from a plan (agent_step, plan_not_released, not_in_plan_revision, edited_since_release) names the plan by its root: the release that fixes it when it is the one plan governing the issue (plan_release takes the root), the nearest plan to look at when several do. A person never claims an agent_step, an Operator step.",
     readOnly: false,
     shape: { id: identifier },
     handler: (ctx, args) => update(ctx, args["id"], { claim: true })
@@ -499,7 +547,7 @@ var TOOLS = [
   },
   {
     name: "comment_list",
-    description: "An issue's full comment thread, untruncated.",
+    description: "An issue's complete comment thread, oldest first. Follows every older page; pagination failures return an error, not a partial thread.",
     readOnly: true,
     shape: { id: identifier },
     handler: (ctx, args) => comments(ctx, args["id"])
@@ -869,9 +917,20 @@ var TOOLS = [
     handler: (ctx) => stats(ctx)
   },
   // ── Plans and gates ──
+  {
+    name: "plan_list",
+    description: `A team's plans, newest first: each plan's id, root (its root issue's identifier, which the other plan tools take in place of the id), title, status, held, revision (null before its first release), released_at and inserted_at. One list of at most ${PLAN_LIST_MAX_LIMIT}, no pages: a second text item says when it came back full. issue_show's plan names the plan an issue belongs to.`,
+    readOnly: true,
+    shape: {
+      team: z.string().optional().describe("team key whose issues root the plans; defaults to HARNESS_TEAM"),
+      status: z.enum(PLAN_STATUSES).optional().describe("only plans in this status"),
+      limit: z.number().int().min(1).max(PLAN_LIST_MAX_LIMIT).optional().describe("maximum plans (default 50)")
+    },
+    handler: (ctx, args) => planList(ctx, { team: args["team"], status: args["status"], limit: args["limit"] })
+  },
   {
     name: "plan_create",
-    description: "Create a plan: a root issue and up to 99 steps, created in one transaction or not at all, and held until a person releases it (plan_release). Steps refer to each other by key: parent (containment) and blocked_by (dependencies). executor operator files a step in the organization's Operator team, where only the plan driver claims it; a person's step goes to its team (or the plan's). conditions are wait conditions (not_before, gate, event); a gate may carry a key (gate: <key> is shorthand) and an owner, who alone ticks it. An invalid plan writes nothing and the error lists every violation by step key. Reuse idempotency_key when retrying.",
+    description: "Create a plan: a root issue and its steps, created in one transaction or not at all, and held until a person releases it (plan_release). Steps refer to each other by key: parent (containment) and blocked_by (dependencies). executor operator files a step in the organization's Operator team, where only the plan driver claims it; a person's step goes to its team (or the plan's). conditions are wait conditions (not_before, gate, event); a gate may carry a key (gate: <key> is shorthand) and an owner, who alone ticks it. An invalid plan writes nothing and the error lists every violation by step key; too_many_steps says which cap the plan is over: the organization's max plan steps (default 1000, which a Harness admin raises in Harness settings \u2192 Plans, up to 2000) or the fixed 100 Operator steps of the delegated grant. Reuse idempotency_key when retrying. Once released, the changes an Operator step proposes need a person's approval in the app, as plan_release says.",
     readOnly: false,
     shape: {
       team: z.string().optional().describe("team key for the root and people's steps; defaults to HARNESS_TEAM"),
@@ -882,14 +941,14 @@ var TOOLS = [
   },
   {
     name: "plan_show",
-    description: "A plan's status, budgets, current revision and spend estimate, and its whole tree root first: each step's key, executor, parent, state, ready flag, held flag (edited since release), in_revision, wait conditions (a gate's key and owner) and waiting_for (each open gate's owner and holders, the people who can tick it: [] when nobody can, null when unowned or not known), plus the blocks edges between steps.",
+    description: "A plan, by its id or its root issue's identifier: status, budgets, current revision and spend estimate, and its whole tree root first: each step's key, executor, parent, state, ready flag, held flag (changed since the release: only an Operator step waits for the next release, a person's stays ready), in_revision, wait conditions (a gate's key and owner) and waiting_for (each open gate's owner and holders, the people who can tick it: [] when nobody can, null when unowned or not known), plus the blocks edges between steps.",
     readOnly: true,
     shape: { id: planId },
     handler: (ctx, args) => planShow(ctx, args["id"])
   },
   {
     name: "plan_edit",
-    description: "Change step executors and keys (each step named by its key or issue identifier) and the plan's budgets. Editing a released step holds it until the plan is released again; a budget edit needs the plan held. Descriptions, parents and edges are edited with issue_update and relation_add/relation_rm; conditions are set at plan_create, and gate_set ticks a gate.",
+    description: "Change step executors and keys (each step named by its key or issue identifier) and the plan's budgets. Editing a released Operator step, or handing one to a person, holds it until the plan is released again; a person's step stays workable, and the next release takes the change in. A budget edit needs the plan held. Descriptions, parents and edges are edited with issue_update and relation_add/relation_rm; conditions are set at plan_create, and gate_set ticks a gate. Once released, the changes an Operator step proposes need a person's approval in the app, as plan_release says.",
     readOnly: false,
     shape: {
       id: planId,
@@ -904,7 +963,7 @@ var TOOLS = [
   },
   {
     name: "plan_release",
-    description: "Release a held plan (or one that needs attention) as the caller: freezes its next revision and lets its ready steps run. A plan with Operator steps needs a spend budget and the caller's right to run Operator; collaborators join its plan room.",
+    description: "Release a held plan (or one that needs attention) as the caller: freezes its next revision, which takes in the steps added or edited since the last one, and lets its ready steps run. A plan over a step cap is refused with too_many_steps, naming the cap as plan_create does. A plan with Operator steps needs a spend budget and the caller's right to run Operator; collaborators join its plan room. Each Operator step runs as a job (jobs_list names its plan_step), and the changes a job proposes need a person's approval in the app: give them the job's approval_url. No tool approves.",
     readOnly: false,
     shape: {
       id: planId,
@@ -927,7 +986,7 @@ var TOOLS = [
   },
   {
     name: "gate_set",
-    description: "Satisfy (satisfied true) or un-satisfy (false) a gate wait condition on an issue, found by its key, label or condition id (condition_list and issue_show list conditions). Needs staff standing in the organization or a place in its plan's room; only an owned gate's owner ticks it, and its owner or staff untick it. Anyone else gets a 403 naming the owner. An outside expert's pxc_ credential ticks the gates it owns on a step assigned to it (assignment_list); any other step is 404.",
+    description: "Satisfy (satisfied true) or un-satisfy (false) a gate wait condition on an issue, found by its key, label or condition id (condition_list and issue_show list conditions). A condition id writes directly, without a staff-only conditions lookup; a key or label needs that lookup. Needs staff standing in the organization or a place in its plan's room; only an owned gate's owner ticks it, and its owner or staff untick it. Anyone else gets a 403 naming the owner. An outside expert's pxc_ credential ticks the gates it owns on a step assigned to it (assignment_list); any other step is 404. An Operator-only login (operator-cli) is refused here, as on every tool outside Operator's, even for a person in the plan's room.",
     readOnly: false,
     shape: {
       issue: identifier,
@@ -954,6 +1013,8 @@ var TOOLS = [
   ...OPERATOR_JOB_TOOLS,
   // ── Operator job controls (CLI-46) ──
   ...OPERATOR_CONTROL_TOOLS,
+  // ── Operator job start (CLI-45) ──
+  ...OPERATOR_RUN_TOOLS,
   // ── Operator job lifecycle (CLI-47) ──
   ...OPERATOR_LIFECYCLE_TOOLS,
   // ── Uploads ──

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allocator-one/harness-cli",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "CLI and MCP server for Harness, allocator.one's issue tracker",
   "type": "module",
   "license": "MIT",