@allocator-one/harness-cli 1.15.1 → 1.16.0

package/dist/{chunk-L2OWOZ4N.js → chunk-GVTZKAXC.js}

@@ -331,6 +331,7 @@ function issueDetail(issue, images = []) {
     ["Priority", issue["priority_label"]],
     ["Assignee", path(issue, "assignee", "name")],
     ["Team", path(issue, "team", "key")],
+    ["Plan", issuePlanLine(issue["plan"])],
     ["Labels", labelsLine(issue["labels"])],
     ["Blocked", blockedLine(issue)],
     ["Waiting", waitingLine(issue)],
@@ -735,6 +736,34 @@ function roleName(role) {
   return words.charAt(0).toUpperCase() + words.slice(1);
 }
 var LIVE_PLAN_STATUSES = ["released", "running", "needs_attention"];
+function plansTable(plans) {
+  const rows = plans.map((plan) => [
+    str(plan["root"]) || "-",
+    str(plan["status"]) || "-",
+    plan["held"] === true ? "yes" : plan["held"] === false ? "no" : "-",
+    typeof plan["revision"] === "number" ? String(plan["revision"]) : "-",
+    truncate(plan["title"])
+  ]);
+  return table(["ROOT", "STATUS", "HELD", "REVISION", "TITLE"], rows);
+}
+function issuePlanLine(plan) {
+  if (typeof plan !== "object" || plan === null || Array.isArray(plan)) return null;
+  const record = plan;
+  const root = clean(record["root"]);
+  if (root === "") return null;
+  const status = record["held"] === true ? "held" : clean(record["status"]);
+  const revision = record["revision"];
+  const parts = [root];
+  if (status !== "") parts.push(status);
+  if (typeof revision === "number") {
+    parts.push(`revision ${revision}`);
+    if (typeof record["in_revision"] === "boolean") parts.push(record["in_revision"] ? "in revision" : "not in revision");
+  } else {
+    parts.push("never released");
+  }
+  if (record["executor"] === "operator") parts.push("Operator step");
+  return parts.join(" \xB7 ");
+}
 function planDetail(plan) {
   const steps = records(plan["steps"]);
   const fields = [
@@ -863,7 +892,7 @@ function holderText(holder) {
 function planHeldSection(heldSteps) {
   if (!Array.isArray(heldSteps) || heldSteps.length === 0) return "";
   return `
-Held by an edit until the plan is released again: ${heldSteps.map((step) => clean(step)).join(", ")}
+Changed since the release: ${heldSteps.map((step) => clean(step)).join(", ")} (only Operator steps are held until the next release takes them in)
 `;
 }
 function indentLines(text) {
@@ -883,11 +912,32 @@ function changesetDetails(details) {
 function violationDetails(violations) {
   return records(violations).map((violation) => {
     const code = clean(violation["code"]);
-    const message = clean(violation["message"]) || code || "invalid";
+    const message = capMessage(violation) ?? (clean(violation["message"]) || code || "invalid");
     return `
   ${violationSubject(violation)}: ${message}${code === "" ? "" : ` [${code}]`}`;
   }).join("");
 }
+var MAX_PLAN_STEPS_CEILING = 2e3;
+function capMessage(violation) {
+  if (violation["code"] !== "too_many_steps") return null;
+  const cap = violation["cap"];
+  if (typeof cap !== "object" || cap === null || Array.isArray(cap)) return null;
+  const { kind, max, count, ceiling: served } = cap;
+  if (!Number.isInteger(max) || !Number.isInteger(count)) return null;
+  if (kind === "operator_steps") {
+    return `the plan has ${count} Operator steps, above the fixed limit of ${max}: Operator's delegated grant caps a plan's agent steps, and no setting raises it \u2014 hand some to people (executor none) or split the plan`;
+  }
+  if (kind === "plan_steps") {
+    const ceiling = Number.isInteger(served) ? served : MAX_PLAN_STEPS_CEILING;
+    const over = `the plan has ${count} steps, above this organization's max plan steps (${max})`;
+    if (count > ceiling && max < ceiling) {
+      return `${over}, and above the ceiling of ${ceiling} that no setting raises past \u2014 split the plan`;
+    }
+    if (max >= ceiling) return `${over}, which is already at its ceiling of ${ceiling} \u2014 split the plan`;
+    return `${over}: a Harness admin can raise "Max plan steps" in Harness settings \u2192 Plans (max_plan_steps, up to ${ceiling})`;
+  }
+  return null;
+}
 function violationSubject(violation) {
   const key = typeof violation["key"] === "string" ? clean(violation["key"]) : null;
   const index = typeof violation["index"] === "number" ? `steps[${violation["index"]}]` : null;
@@ -1185,6 +1235,9 @@ var UUID_FORMAT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
 function isUuid(value) {
   return UUID_FORMAT.test(value);
 }
+function isIdentifier(value) {
+  return IDENTIFIER_FORMAT.test(value);
+}
 function requireIdentifiers(identifiers) {
   const bad = identifiers.filter((identifier) => !IDENTIFIER_FORMAT.test(identifier));
   if (bad.length > 0) {
@@ -1514,18 +1567,42 @@ ${opts.appendNotes}`;
   return { json: issue, human };
 }
 var CLAIM_REFUSAL_HINTS = {
-  // The edit holds a released step, so the plan needs releasing again before
-  // the step is claimable.
-  agent_step: () => `Operator runs it for its plan; to do it yourself, set its executor to none (${invokedName()} plan edit <plan-id>) and release the plan again`,
+  // A person never claims an Operator step, so releasing the plan is not the
+  // fix: handing the step to a person is, and a handed-over Operator step
+  // stays frozen until the next release.
+  agent_step: (_identifier, plan) => {
+    const runs = plan.kind === "sole" ? `plan ${plan.root}` : plan.kind === "nearest" ? `its plans (several govern it; the nearest is ${plan.root})` : "its plan";
+    const target = plan.kind === "sole" ? plan.root : "<plan>";
+    return `a person can't claim an Operator step: Operator runs it for ${runs}. To do it yourself, set its executor to none (${invokedName()} plan edit ${target}) and release the plan again`;
+  },
+  plan_not_released: (_identifier, plan) => planReleaseHint(plan),
+  not_in_plan_revision: (_identifier, plan) => planReleaseHint(plan),
+  edited_since_release: (_identifier, plan) => planReleaseHint(plan),
   waiting_on_condition: (identifier) => `${invokedName()} show ${identifier} lists what it waits on; tick a gate with ${invokedName()} gate satisfy ${identifier} <gate>`
 };
+function planReleaseHint(plan) {
+  if (plan.kind === "sole") return plan.release ? `run ${invokedName()} plan release ${plan.root}` : void 0;
+  if (plan.kind === "nearest") {
+    return `several plans govern it; the nearest is ${plan.root} (${invokedName()} plan show ${plan.root})`;
+  }
+  return void 0;
+}
 function explainClaimRefusal(error, identifier) {
   if (!(error instanceof HttpError) || error.status !== 409) return error;
   const reason = error.body["reason"];
-  const hint = typeof reason === "string" && Object.hasOwn(CLAIM_REFUSAL_HINTS, reason) ? CLAIM_REFUSAL_HINTS[reason](identifier) : void 0;
+  const hint = typeof reason === "string" && Object.hasOwn(CLAIM_REFUSAL_HINTS, reason) ? CLAIM_REFUSAL_HINTS[reason](identifier, refusingPlan(error.body)) : void 0;
   if (hint === void 0) return error;
   return new HttpError(error.status, `${error.message} \u2014 ${hint}`, error.body, error.retryAfter);
 }
+function refusingPlan(body) {
+  const plan = body["plan"];
+  if (typeof plan !== "object" || plan === null || Array.isArray(plan)) return { kind: "none" };
+  const root = plan["root"];
+  if (typeof root !== "string" || !isIdentifier(root)) return { kind: "none" };
+  const message = typeof body["message"] === "string" ? body["message"] : "";
+  if (!new RegExp(`\\bplan ${root}\\b`).test(message)) return { kind: "nearest", root };
+  return { kind: "sole", root, release: new RegExp(`\\brelease plan ${root}\\b`).test(message) };
+}
 function requireCloseArgs(identifiers, opts) {
   if (identifiers.length === 0) {
     throw new UsageError(
@@ -4273,6 +4350,9 @@ import { parseDocument } from "yaml";
 var PLAN_EXECUTORS = ["none", "operator"];
 var CONDITION_KINDS = ["not_before", "gate", "event"];
 var GATE_OWNER_ROLES = ["gp", "compliance_officer", "valuer", "accountant", "auditor", "counsel"];
+var PLAN_STATUSES = ["held", "released", "running", "completed", "needs_attention"];
+var PLAN_LIST_MAX_LIMIT = 100;
+var PLAN_LIST_DEFAULT_LIMIT = 50;
 function parsePlanDocument(text, source) {
   const parsed = extname2(source).toLowerCase() === ".json" ? parseJson(text, source) : parseYamlDocument(text, source);
   if (!isRecord5(parsed)) {
@@ -4335,13 +4415,44 @@ Nothing runs until it is released: ${invokedName()} plan release ${clean(id)}
 `
   };
 }
+function requirePlanListArgs(opts) {
+  if (opts.status !== void 0 && !PLAN_STATUSES.includes(opts.status)) {
+    throw new UsageError(`status must be one of: ${PLAN_STATUSES.join(", ")}`);
+  }
+  if (opts.limit !== void 0 && (!Number.isInteger(opts.limit) || opts.limit < 1 || opts.limit > PLAN_LIST_MAX_LIMIT)) {
+    throw new UsageError(`--limit takes 1 to ${PLAN_LIST_MAX_LIMIT}: the server returns at most ${PLAN_LIST_MAX_LIMIT} plans`);
+  }
+}
+async function planList(ctx, opts) {
+  requirePlanListArgs(opts);
+  const team = requiredTeam(ctx, opts.team);
+  let body;
+  try {
+    body = await ctx.client.get(`/api/v1/teams/${team}/plans`, { status: opts.status, limit: opts.limit });
+  } catch (error) {
+    throw explainMissing(error, `no team ${team} here, or this Harness server cannot list plans yet`);
+  }
+  if (!Array.isArray(body.data)) throw new CommandError("The plan list response carried no list.");
+  const list3 = body.data.filter(isRecord5);
+  const limit = opts.limit ?? PLAN_LIST_DEFAULT_LIMIT;
+  let notice;
+  if (list3.length >= limit) {
+    notice = limit < PLAN_LIST_MAX_LIMIT ? `harness: showing the newest ${list3.length} plans \u2014 pass --limit (up to ${PLAN_LIST_MAX_LIMIT}) for older ones.
+` : `harness: showing the newest ${list3.length} plans, the most one list returns \u2014 narrow it with --status.
+`;
+  }
+  const what = opts.status === void 0 ? "plans" : `${opts.status} plans`;
+  const human = list3.length === 0 ? `No ${what} in team ${team}.
+` : plansTable(list3);
+  return notice === void 0 ? { json: body.data, human } : { json: body.data, human, notice };
+}
 async function planShow(ctx, id) {
-  requirePlanId(id);
+  requirePlanRef(id);
   const plan = await planRequest(id, () => ctx.client.get(`/api/v1/plans/${id}`));
   return { json: plan, human: planDetail(plan) };
 }
 async function planEdit(ctx, id, edits) {
-  requirePlanId(id);
+  requirePlanRef(id);
   requireDocument(edits, "a plan edit is one object: steps to change and budgets");
   const plan = await planRequest(id, () => ctx.client.patch(`/api/v1/plans/${id}`, edits));
   const held = Array.isArray(plan["held_steps"]) && plan["held_steps"].length > 0;
@@ -4350,12 +4461,12 @@ async function planEdit(ctx, id, edits) {
     human: `Updated plan ${clean(id)}
 
 ` + planDetail(plan) + (held ? `
-Release it again to run the held steps: ${invokedName()} plan release ${clean(id)}
+Only Operator steps are held until the next release; release the plan again to take in the changes: ${invokedName()} plan release ${clean(id)}
 ` : "")
   };
 }
 async function planRelease(ctx, id, opts) {
-  requirePlanId(id);
+  requirePlanRef(id);
   const body = {};
   if (opts.collaborators !== void 0 && opts.collaborators.length > 0) body["collaborators"] = opts.collaborators;
   if (opts.retryBudget !== void 0) body["retry_budget"] = opts.retryBudget;
@@ -4370,7 +4481,7 @@ async function planRelease(ctx, id, opts) {
   };
 }
 async function planHold(ctx, id) {
-  requirePlanId(id);
+  requirePlanRef(id);
   const plan = await planRequest(id, () => ctx.client.post(`/api/v1/plans/${id}/hold`));
   return {
     json: plan,
@@ -4383,25 +4494,41 @@ async function gateSet(ctx, issue, gate, satisfied) {
   const wanted = gate.trim();
   if (wanted === "") throw new UsageError("name the gate by its key, its label or its condition id");
   const expert = isExpertToken(ctx.config.token);
-  const list3 = await readConditions(ctx, issue, expert);
-  const target = findGate(list3, issue, wanted, expert);
+  let list3 = null;
+  if (!isUuid(wanted)) {
+    try {
+      list3 = await readConditions(ctx, issue, expert);
+    } catch (error) {
+      if (error instanceof HttpError && error.status === 403) {
+        throw new HttpError(
+          error.status,
+          `${error.message} \u2014 find the gate by its condition id; only Harness staff can list an issue's conditions`,
+          error.body,
+          error.retryAfter
+        );
+      }
+      throw error;
+    }
+  }
+  const target = list3 === null ? { id: wanted.toLowerCase(), label: wanted.toLowerCase() } : findGate(list3, issue, wanted, expert);
   const id = str7(target["id"]);
   let body;
   try {
     body = await ctx.client.put(`/api/v1/issues/${issue}/conditions/${id}/satisfaction`, { satisfied });
   } catch (error) {
-    throw await explainNotGateOwner(ctx, error, target, issue, satisfied);
+    throw await explainNotGateOwner(ctx, error, target, issue, satisfied, list3 !== null);
   }
-  const others = list3.filter((condition) => condition["id"] !== id && condition["satisfied"] !== true).length;
+  const others = list3?.filter((condition) => condition["id"] !== id && condition["satisfied"] !== true).length ?? 0;
   let tail = "";
-  if (satisfied && expert) {
+  if (satisfied && list3 !== null && expert) {
     tail = others > 0 ? ` \u2014 ${others} other gate${others === 1 ? "" : "s"} of yours on it ${others === 1 ? "is" : "are"} open` : "";
-  } else if (satisfied) {
+  } else if (satisfied && list3 !== null) {
     tail = others > 0 ? ` \u2014 it still waits on ${others} other condition${others === 1 ? "" : "s"}` : " \u2014 no other wait condition holds it";
   }
+  const label = list3 === null && isRecord5(body.data) ? body.data["label"] ?? id : target["label"];
   return {
     json: body.data,
-    human: `${satisfied ? "Satisfied" : "Un-satisfied"} gate "${clean(target["label"])}" on ${issue}${tail}
+    human: `${satisfied ? "Satisfied" : "Un-satisfied"} gate "${clean(label)}" on ${issue}${tail}
 `
   };
 }
@@ -4435,8 +4562,10 @@ async function readConditions(ctx, issue, expert) {
   if (!Array.isArray(conditions)) throw new CommandError("The conditions response carried no list.");
   return conditions.filter(isRecord5);
 }
-function requirePlanId(id) {
-  if (!isUuid(id)) throw new UsageError(`not a plan id: ${id} (expected the plan's UUID)`);
+function requirePlanRef(id) {
+  if (!isUuid(id) && !isIdentifier(id)) {
+    throw new UsageError(`not a plan: ${id} (expected the plan's id or its root issue's identifier, e.g. FR-1)`);
+  }
 }
 function requireDocument(value, what) {
   if (!isRecord5(value)) throw new UsageError(what);
@@ -4445,18 +4574,21 @@ async function planRequest(id, send) {
   try {
     return (await send()).data;
   } catch (error) {
-    throw explainMissing(error, `no plan ${id} in this organization, or this Harness server has no plan API yet`);
+    throw explainMissing(
+      error,
+      isUuid(id) ? `no plan ${id} in this organization, or this Harness server has no plan API yet` : `${id} roots no plan in this organization (${invokedName()} show ${id} names the plan an issue belongs to, by its root), or this Harness server opens plans by their id only`
+    );
   }
 }
 function explainMissing(error, why) {
   if (!(error instanceof HttpError) || error.status !== 404) return error;
   return new HttpError(404, `${error.message} \u2014 ${why}`, error.body, error.retryAfter);
 }
-async function explainNotGateOwner(ctx, error, gate, issue, satisfied) {
+async function explainNotGateOwner(ctx, error, gate, issue, satisfied, allowLookup) {
   if (!(error instanceof HttpError) || error.status !== 403 || error.body["reason"] !== "not_gate_owner") return error;
   let current;
   let currentOwner = error.body["owner"];
-  if (currentOwner !== null && !isRecord5(currentOwner)) {
+  if (allowLookup && currentOwner !== null && !isRecord5(currentOwner)) {
     try {
       const fresh = (await ctx.client.get(`/api/v1/issues/${issue}/conditions`)).data;
       if (Array.isArray(fresh)) current = fresh.filter(isRecord5).find((condition) => condition["id"] === gate["id"]);
@@ -4473,23 +4605,17 @@ async function explainNotGateOwner(ctx, error, gate, issue, satisfied) {
 var gateLabel = (condition) => str7(condition["label"]).trim();
 var gateKey = (condition) => str7(condition["key"]);
 function exactMatches(conditions, wanted) {
-  const id = isUuid(wanted) ? wanted.toLowerCase() : null;
-  return conditions.filter((condition) => {
-    if (id !== null && str7(condition["id"]).toLowerCase() === id) return true;
-    if (condition["kind"] !== "gate") return false;
-    const key = gateKey(condition);
-    return key !== "" && key === (id ?? wanted) || gateLabel(condition) === wanted;
-  });
+  return conditions.filter(
+    (condition) => condition["kind"] === "gate" && (gateKey(condition) !== "" && gateKey(condition) === wanted || gateLabel(condition) === wanted)
+  );
 }
 function ambiguous(conditions, issue, wanted, matches) {
   const listed = matches.map((condition) => {
     const what = condition["kind"] === "gate" ? `gate ${gateName({ label: gateLabel(condition), key: gateKey(condition) })}` : `${clean(condition["kind"])} condition`;
     return `${clean(condition["id"])} (${what})`;
   }).join(", ");
-  const unnameable = matches.map((condition) => str7(condition["id"])).filter((id) => exactMatches(conditions, id).length !== 1).map((id) => clean(id));
-  const caveat = unnameable.length === 0 ? "" : ` (${unnameable.join(", ")} ${unnameable.length === 1 ? "is" : "are"} also another gate's key or label, so ${unnameable.length === 1 ? "it" : "they"} cannot be named by id)`;
   return new CommandError(
-    `several gates on ${issue} match "${wanted}": ${listed} \u2014 pass the condition id of the one you mean${caveat}`
+    `several gates on ${issue} match "${wanted}": ${listed} \u2014 pass the condition id of the one you mean`
   );
 }
 function findGate(conditions, issue, wanted, expert = false) {
@@ -4497,11 +4623,6 @@ function findGate(conditions, issue, wanted, expert = false) {
   if (exact.length > 1) throw ambiguous(conditions, issue, wanted, exact);
   if (exact.length === 1) {
     const only = exact[0];
-    if (only["kind"] !== "gate") {
-      throw new CommandError(
-        `condition ${wanted} on ${issue} is a ${clean(only["kind"])} condition \u2014 only a gate is satisfied by hand`
-      );
-    }
     return only;
   }
   const gates = conditions.filter((condition) => condition["kind"] === "gate");
@@ -4511,7 +4632,6 @@ function findGate(conditions, issue, wanted, expert = false) {
   );
   if (loose.length > 1) throw ambiguous(conditions, issue, wanted, loose);
   if (loose.length === 1) return loose[0];
-  if (isUuid(wanted)) throw new CommandError(`No condition ${wanted} on ${issue}${expert ? " that you own" : ""}.`);
   const none = expert ? `No gate of yours on ${issue}` : `No gate on ${issue}`;
   if (gates.length === 0) {
     throw new CommandError(`${none} matches "${wanted}" \u2014 ${expert ? "you own no gate on it" : "it has no gates"}`);
@@ -4544,6 +4664,7 @@ function isRecord6(value) {
 }
 
 // src/core/credentials.ts
+import { createHash } from "crypto";
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir } from "os";
 import { dirname as dirname2, isAbsolute, join as join2 } from "path";
@@ -4552,6 +4673,15 @@ function defaultCredentialsPath(env = process.env) {
   const base = xdg !== void 0 && xdg !== "" && isAbsolute(xdg) ? xdg : join2(homedir(), ".config");
   return join2(base, "harness", "credentials.json");
 }
+function orgCredentialsPath(path2, baseUrl, org) {
+  const url = new URL(baseUrl);
+  const host = url.origin + url.pathname.replace(/\/+$/, "");
+  const key = createHash("sha256").update(JSON.stringify([path2, host, org.toLowerCase()])).digest("hex");
+  return join2(dirname2(path2), `credentials-org-${key}.json`);
+}
+function validOrgId(org) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(org);
+}
 function readCredentials(path2) {
   try {
     const parsed = JSON.parse(readFileSync3(path2, "utf8"));
@@ -4666,6 +4796,10 @@ function resolveConfig(env = process.env, credentialsPath, repo) {
   const envUrl = blankToNull(env["HARNESS_API_URL"]);
   const envToken = blankToNull(env["HARNESS_API_TOKEN"]);
   const repoUrl = repo?.url?.replace(/\/+$/, "") ?? null;
+  const org = envToken === null ? repo?.org?.toLowerCase() : void 0;
+  if (org !== void 0 && !validOrgId(org)) {
+    return { kind: "error", message: `repo org in ${repo?.path} must be an organization UUID`, warnings };
+  }
   let rawUrl;
   let hostSource;
   if (envUrl !== null) {
@@ -4684,6 +4818,9 @@ function resolveConfig(env = process.env, credentialsPath, repo) {
   } else if (repoUrl !== null) {
     rawUrl = repoUrl;
     hostSource = "repo-config";
+  } else if (org !== void 0) {
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
   } else if (stored !== null) {
     rawUrl = stored.url;
     hostSource = "stored-login";
@@ -4694,13 +4831,16 @@ function resolveConfig(env = process.env, credentialsPath, repo) {
   const validated = validateBaseUrl(rawUrl);
   if (!validated.ok) return { kind: "error", message: validated.message, warnings };
   const baseUrl = rawUrl.replace(/\/+$/, "");
+  const selectedPath = org === void 0 ? path2 : orgCredentialsPath(path2, baseUrl, org);
+  const selected = org === void 0 ? stored : readCredentials(selectedPath);
   let token;
   if (envToken !== null) {
     token = envToken;
-  } else if (stored !== null && normalize(stored.url) !== null && normalize(stored.url) === normalize(baseUrl)) {
-    token = stored.token;
+  } else if (selected !== null && normalize(selected.url) !== null && normalize(selected.url) === normalize(baseUrl)) {
+    token = selected.token;
   } else {
-    const result = { kind: "needs-login", baseUrl, hostSource, warnings };
+    const result = { kind: "needs-login", baseUrl, hostSource, credentialsPath: selectedPath, warnings };
+    if (org !== void 0) result.org = org;
     if (hostSource === "repo-config" && repo?.path !== void 0) result.repoConfigPath = repo.path;
     return result;
   }
@@ -4714,7 +4854,8 @@ function resolveConfig(env = process.env, credentialsPath, repo) {
       // the --team flag at the command layer) stays authoritative.
       team: blankToNull(env["HARNESS_TEAM"]) ?? repo?.team ?? null,
       cacheDir: resolveCacheDir(env),
-      hostSource
+      hostSource,
+      credentialsPath: selectedPath
     },
     warnings
   };
@@ -4753,10 +4894,11 @@ function validateBaseUrl(baseUrl) {
   }
   if (parsed.protocol === "https:" && parsed.hostname !== "") return { ok: true };
   if (parsed.protocol === "http:") {
-    if (["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname)) return { ok: true };
+    const host = parsed.hostname;
+    if (["localhost", "127.0.0.1", "[::1]"].includes(host) || host.endsWith(".localhost")) return { ok: true };
     return {
       ok: false,
-      message: `refusing plain-http HARNESS_API_URL (${baseUrl}) \u2014 the API token would travel in cleartext. Use https, or http against localhost only.`
+      message: `refusing plain-http HARNESS_API_URL (${baseUrl}) \u2014 the API token would travel in cleartext. Use https, or http against localhost, *.localhost, 127.0.0.1 or [::1] only.`
     };
   }
   return { ok: false, message: `HARNESS_API_URL must be an http(s) URL with a host, got: ${baseUrl}` };
@@ -4913,17 +5055,23 @@ export {
   PLAN_EXECUTORS,
   CONDITION_KINDS,
   GATE_OWNER_ROLES,
+  PLAN_STATUSES,
+  PLAN_LIST_MAX_LIMIT,
   readPlanFile,
   planCreate,
+  requirePlanListArgs,
+  planList,
   planShow,
   planEdit,
   planRelease,
   planHold,
   gateSet,
   conditionList,
-  requirePlanId,
+  requirePlanRef,
   assignments,
   defaultCredentialsPath,
+  orgCredentialsPath,
+  validOrgId,
   readCredentials,
   writeCredentials,
   deleteCredentials,