@allocator-one/harness-cli 1.15.1 → 1.16.0

package/dist/cli.js

@@ -14,6 +14,8 @@ import {
   JOBS_MAX_PAGES,
   JOB_STATES,
   LocalError,
+  PLAN_LIST_MAX_LIMIT,
+  PLAN_STATUSES,
   RELATION_CREATE_TYPES,
   RELATION_UPDATE_TYPES,
   SESSION_PATH,
@@ -73,9 +75,11 @@ import {
   memberSetRole,
   milestoneCreate,
   milestoneList,
+  orgCredentialsPath,
   planCreate,
   planEdit,
   planHold,
+  planList,
   planRelease,
   planShow,
   prepareProcedureRun,
@@ -100,7 +104,8 @@ import {
   requireIdentifiers,
   requireJobId,
   requireJobsArgs,
-  requirePlanId,
+  requirePlanListArgs,
+  requirePlanRef,
   requireProcedureId,
   requireProcedureName,
   requireReadyClaimArgs,
@@ -133,13 +138,14 @@ import {
   update,
   upload,
   userList,
+  validOrgId,
   validateBaseUrl,
   validateIdempotencyKey,
   version,
   watchStopSignal,
   workflowStates,
   writeCredentials
-} from "./chunk-L2OWOZ4N.js";
+} from "./chunk-GVTZKAXC.js";
 import {
   CLI_VERSION,
   OPERATOR_PACKAGE,
@@ -336,6 +342,172 @@ async function exec(ctx, opts) {
   return { json: { exit_code: exitCode }, human: "", exitCode };
 }
 
+// src/commands/review.ts
+import { execFileSync } from "child_process";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var SLUG = /^([\w.-]+)\/([\w.-]+)$/;
+function githubSlug(remote) {
+  const match = /^(?:(?:https?|ssh|git):\/\/(?:[^@/\s]+@)?|[\w.-]+@)github\.com[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/i.exec(remote.trim());
+  return match ? `${match[1]}/${match[2]}` : void 0;
+}
+function originRemote() {
+  try {
+    const url = execFileSync("git", ["remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return githubSlug(url);
+  } catch {
+    return void 0;
+  }
+}
+function prNumber(digits, input) {
+  const number = Number(digits);
+  if (!Number.isSafeInteger(number) || number < 1) throw new UsageError(`not a pull request number: ${input}`);
+  return number;
+}
+var NAME = /^[\w.-]+$/;
+function fromUrl(input) {
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    return null;
+  }
+  if (!["https:", "http:"].includes(url.protocol) || !/^(www\.)?github\.com$/i.test(url.hostname)) return null;
+  let segments;
+  try {
+    segments = url.pathname.split("/").filter((segment) => segment !== "").map(decodeURIComponent);
+  } catch {
+    return null;
+  }
+  const [owner, repo, kind, number] = segments;
+  if (kind !== "pull" || !owner || !repo || !number || !NAME.test(owner) || !NAME.test(repo) || !/^\d+$/.test(number)) {
+    return null;
+  }
+  return [owner, repo, number];
+}
+function parsePullRequest(input, repo, origin = originRemote) {
+  const trimmed = input.trim();
+  const url = fromUrl(trimmed);
+  if (url) return { owner: url[0], repo: url[1], number: prNumber(url[2], input) };
+  const named2 = /^([\w.-]+)\/([\w.-]+)#(\d+)$/.exec(trimmed);
+  if (named2) return { owner: named2[1], repo: named2[2], number: prNumber(named2[3], input) };
+  const bare = /^#?(\d+)$/.exec(trimmed);
+  if (!bare) throw new UsageError(`not a pull request: ${input} \u2014 use owner/repo#<pr>, its URL, or <pr> with --repo`);
+  const slug = repo ?? origin();
+  const parts = slug === void 0 ? null : SLUG.exec(slug.trim());
+  if (!parts) throw new UsageError("name the repository: owner/repo#<pr>, the pull request URL, or --repo owner/repo");
+  return { owner: parts[1], repo: parts[2], number: prNumber(bare[1], input) };
+}
+var label = (pr) => `${pr.owner}/${pr.repo}#${pr.number}`;
+var gatePath = (pr) => `/api/v1/reviews/prs/${encodeURIComponent(pr.owner)}/${encodeURIComponent(pr.repo)}/${pr.number}`;
+async function fetchGate(ctx, pr) {
+  const body = await ctx.client.get(gatePath(pr));
+  if (!isRecord2(body.data)) throw new CommandError(`unexpected gate status for ${label(pr)}: no data`);
+  return body.data;
+}
+function latestAttempt(lifecycle) {
+  const attempts = Array.isArray(lifecycle["attempts"]) ? lifecycle["attempts"].filter(isRecord2) : [];
+  return attempts.reduce(
+    (latest, attempt) => latest === void 0 || Number(attempt["number"]) > Number(latest["number"]) ? attempt : latest,
+    void 0
+  );
+}
+function recovery(lifecycle) {
+  const latest = latestAttempt(lifecycle);
+  const sent = isRecord2(lifecycle["recovery"]) ? lifecycle["recovery"] : void 0;
+  const state2 = String(sent?.["state"] ?? latest?.["state"] ?? "");
+  if (state2 !== "failed" && state2 !== "timed_out") return void 0;
+  const reason = sent?.["terminal_reason"] ?? latest?.["terminal_reason"];
+  return {
+    number: latest?.["number"],
+    state: state2 === "timed_out" ? "timed out" : state2,
+    reason: typeof reason === "string" ? reason : null,
+    evidence: sent ? sent["evidence_recorded"] === true : latest?.["review_run_id"] != null,
+    next: sent?.["next"] === "automatic_retry" ? "automatic_retry" : "retry"
+  };
+}
+function describe(r) {
+  const why = [r.reason, r.evidence ? null : "no evidence recorded"].filter((part) => part !== null).join(", ");
+  return `attempt ${clean(String(r.number))} ${r.state}${why === "" ? "" : ` (${clean(why)})`}`;
+}
+function projection(gate2, key) {
+  const value = gate2[key];
+  return isRecord2(value) && typeof value["status"] === "string" ? clean(value["status"]) : "unknown";
+}
+async function status(ctx, pr) {
+  const gate2 = await fetchGate(ctx, pr);
+  const lifecycle = isRecord2(gate2["lifecycle"]) ? gate2["lifecycle"] : void 0;
+  const head = isRecord2(gate2["head"]) && typeof gate2["head"]["sha"] === "string" ? gate2["head"]["sha"].slice(0, 10) : "?";
+  const lines = [
+    `${label(pr)} at ${clean(head)}`,
+    `enforced: ${projection(gate2, "enforced")}   advisory: ${projection(gate2, "advisory")}`
+  ];
+  if (lifecycle) {
+    lines.push(`gate check: ${clean(String(lifecycle["state"] ?? "unknown")).replaceAll("_", " ")}`);
+    const r = recovery(lifecycle);
+    if (r) {
+      lines.push(`latest ${describe(r)}`);
+      lines.push(
+        r.next === "automatic_retry" ? "Harness retries it automatically; check again shortly." : named(`Retry it with: harness review retry ${label(pr)} --reason "\u2026"`)
+      );
+    }
+  }
+  return { json: gate2, human: lines.join("\n") + "\n" };
+}
+var REFUSALS = {
+  execution_not_terminal: "the latest attempt is still running; wait for it to finish",
+  attempt_changed: "another attempt was created meanwhile; read the status and run this again",
+  check_changed: "the head's gate check changed meanwhile; run this again",
+  head_changed: "the pull request's head moved; the new head gets its own check",
+  advisory_not_converged: "the head's advisory review has not converged; converge it first",
+  retry_conflict: "this attempt was already retried with a different reason",
+  merged: "the pull request is merged"
+};
+async function retry(ctx, pr, reason) {
+  const gate2 = await fetchGate(ctx, pr);
+  const lifecycle = isRecord2(gate2["lifecycle"]) ? gate2["lifecycle"] : void 0;
+  if (!lifecycle || typeof lifecycle["check_id"] !== "string" || typeof lifecycle["head_sha"] !== "string") {
+    throw new CommandError(`${label(pr)} has no gate check at its current head: nothing to retry`);
+  }
+  const r = recovery(lifecycle);
+  if (r?.next === "automatic_retry") {
+    throw new CommandError(named(`Harness retries attempt ${clean(String(r.number))} itself; run harness review status ${label(pr)} shortly`));
+  }
+  const previous = latestAttempt(lifecycle);
+  const previousId = typeof previous?.["id"] === "string" ? previous["id"] : null;
+  const body = {
+    head_sha: lifecycle["head_sha"],
+    check_id: lifecycle["check_id"],
+    previous_attempt_id: previousId,
+    // One key per attempt retried: running this again for the same attempt returns the attempt already
+    // queued instead of paying for another review run.
+    request_key: `harness-cli:${previousId ?? lifecycle["check_id"]}`,
+    reason: reason?.trim() || "Retry requested with harness review retry"
+  };
+  let response;
+  try {
+    response = await ctx.client.post(`${gatePath(pr)}/retry`, body, { actor: false });
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 409) {
+      const code = error.message.trim().split(/[\s:]+/).pop() ?? "";
+      throw new CommandError(`could not retry ${label(pr)}: ${REFUSALS[code] ?? clean(error.message)}`);
+    }
+    if (error instanceof HttpError && error.status === 403) {
+      throw new CommandError(`${error.message} \u2014 a retry needs a login with reviews:write`);
+    }
+    throw error;
+  }
+  const attempt = isRecord2(response.data) ? response.data : {};
+  const outcome = response["outcome"];
+  const verb = outcome === "existing" ? "Already queued" : "Queued";
+  return {
+    json: { attempt, outcome },
+    human: `${verb} attempt ${clean(String(attempt["number"]))} (${clean(String(attempt["id"]))}) for ${label(pr)}
+`
+  };
+}
+
 // src/core/auth.ts
 import { createHash, randomBytes } from "crypto";
 import { execFile } from "child_process";
@@ -365,6 +537,9 @@ function challengeFor(verifier) {
 async function login(baseUrl, options = {}) {
   const validated = validateBaseUrl(baseUrl);
   if (!validated.ok) return { ok: false, message: validated.message };
+  if (options.org !== void 0 && !validOrgId(options.org)) {
+    return { ok: false, message: "org must be an organization UUID" };
+  }
   const base = baseUrl.replace(/\/+$/, "");
   if (options.noBrowser === true || !browserAvailable(options)) {
     return manualLogin(base, options);
@@ -437,6 +612,7 @@ async function loopbackLogin(baseUrl, options) {
       const detail = error instanceof Error ? error.message : String(error);
       return { ok: false, message: `could not open a browser: ${detail}` };
     }
+    if (options.org !== void 0) notify(`Choose organization ${options.org} on the login page; another organization's token will be refused.`);
     notify(`Opening ${url}`);
     notify("Waiting for the browser authorization (Ctrl-C to abort)\u2026");
     const callback = await callbackPromise;
@@ -523,15 +699,15 @@ function awaitCallback(server, state2, timeoutMs) {
     });
     server.on("request", (request, response) => {
       const respond = callbackResponder(response);
-      const respondWithPage = (status, message, pageState) => {
+      const respondWithPage = (status2, message, pageState) => {
         if (callbackPageResponses >= MAX_PAGE_RESPONSES) {
           respondEmpty(response, 429);
           return Promise.resolve();
         }
         callbackPageResponses += 1;
-        return respond(status, message, pageState);
+        return respond(status2, message, pageState);
       };
-      const respondAtRoot = (status, message, pageState) => {
+      const respondAtRoot = (status2, message, pageState) => {
         const rootPhase = phase === "terminal" ? "terminal" : "waiting";
         const responses = rootPageResponses.get(rootPhase) ?? 0;
         if (responses >= MAX_PAGE_RESPONSES) {
@@ -539,7 +715,7 @@ function awaitCallback(server, state2, timeoutMs) {
           return Promise.resolve();
         }
         rootPageResponses.set(rootPhase, responses + 1);
-        return respond(status, message, pageState);
+        return respond(status2, message, pageState);
       };
       let url;
       try {
@@ -623,12 +799,12 @@ function awaitCallback(server, state2, timeoutMs) {
         resolve({
           ok: true,
           code,
-          respond: async (status, message, pageState) => {
-            finalResponse = { status, message, pageState };
+          respond: async (status2, message, pageState) => {
+            finalResponse = { status: status2, message, pageState };
             phase = "terminal";
             const responders = acceptedResponders.splice(0);
             await Promise.all(
-              responders.map((acceptedRespond) => trackResponse(acceptedRespond(status, message, pageState)))
+              responders.map((acceptedRespond) => trackResponse(acceptedRespond(status2, message, pageState)))
             );
             await drainTrackedResponses();
           }
@@ -640,7 +816,7 @@ function awaitCallback(server, state2, timeoutMs) {
   });
 }
 function callbackResponder(response) {
-  return async (status, message, state2) => {
+  return async (status2, message, state2) => {
     if (response.writableEnded || response.destroyed) return;
     return new Promise((resolve) => {
       let flushTimer;
@@ -671,7 +847,7 @@ function callbackResponder(response) {
         }
         try {
           const html = loginPage(message, state2);
-          response.writeHead(status, {
+          response.writeHead(status2, {
             "cache-control": "no-store",
             connection: "close",
             "content-length": String(Buffer.byteLength(html)),
@@ -691,10 +867,10 @@ function callbackResponder(response) {
     });
   };
 }
-function respondEmpty(response, status) {
+function respondEmpty(response, status2) {
   response.once("error", () => void 0);
   try {
-    response.writeHead(status, {
+    response.writeHead(status2, {
       "cache-control": "no-store",
       connection: "close",
       "x-content-type-options": "nosniff"
@@ -733,6 +909,7 @@ async function exchangeCode(baseUrl, code, verifier, options) {
 async function manualLogin(baseUrl, options) {
   const notify = options.notify ?? defaultNotify;
   const prompt = options.prompt ?? defaultPrompt;
+  if (options.org !== void 0) notify(`Choose organization ${options.org} on the login page; another organization's token will be refused.`);
   notify(
     `Open ${baseUrl}/cli/login in a browser, authorize, and paste the token below (an outside expert pastes the pxc_ credential minted in their expert view instead).`
   );
@@ -741,17 +918,23 @@ async function manualLogin(baseUrl, options) {
   return verifyAndStore(baseUrl, token, options, { minted: false, kind: null });
 }
 async function verifyAndStore(baseUrl, token, options, received) {
-  const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
+  const defaultPath = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
+  const path = options.org === void 0 ? defaultPath : orgCredentialsPath(defaultPath, baseUrl, options.org);
   const client = bareClient(baseUrl, token, options);
   const expert = isExpertToken(token);
   let kind = received.kind;
   try {
     if (expert) {
+      if (options.org !== void 0) return { ok: false, message: "cannot verify an outside expert credential against a repo org \u2014 nothing was stored" };
       await client.get(EXPERT_ASSIGNMENTS_PATH);
     } else {
       const described = isLoginCredential(token) ? await describeSession(client) : null;
+      if (described !== null) kind = described.session.kind ?? kind;
+      if (options.org !== void 0 && (typeof described?.session.org?.["id"] !== "string" || described.session.org["id"].toLowerCase() !== options.org.toLowerCase())) {
+        const revoked = received.minted && await revokeSession(client, token);
+        return { ok: false, message: `the received token does not verify organization ${options.org} \u2014 nothing was stored` + (revoked ? ", and the token was revoked" : "") };
+      }
       if (described === null) await client.get("/api/v1/teams");
-      else kind = described.session.kind ?? kind;
     }
   } catch (error) {
     if (error instanceof HttpError) {
@@ -815,14 +998,14 @@ async function describeSession(client) {
   }
 }
 function sessionOf(data) {
-  if (!isRecord2(data)) return NO_SESSION;
+  if (!isRecord3(data)) return NO_SESSION;
   const text = (value) => typeof value === "string" ? value : null;
   return {
     kind: text(data["kind"]),
     expires_at: text(data["expires_at"]),
     scopes: Array.isArray(data["scopes"]) ? data["scopes"].filter((scope) => typeof scope === "string") : null,
-    user: isRecord2(data["user"]) ? data["user"] : null,
-    org: isRecord2(data["org"]) ? data["org"] : null
+    user: isRecord3(data["user"]) ? data["user"] : null,
+    org: isRecord3(data["org"]) ? data["org"] : null
   };
 }
 async function revokeSession(client, token) {
@@ -957,12 +1140,12 @@ function sessionLines(session) {
   return lines;
 }
 function expertSeat(data) {
-  if (!isRecord2(data) || !isRecord2(data["expert"])) return null;
-  const plan2 = isRecord2(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
-  const steps = Array.isArray(data["assignments"]) ? data["assignments"].filter(isRecord2).length : 0;
+  if (!isRecord3(data) || !isRecord3(data["expert"])) return null;
+  const plan2 = isRecord3(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
+  const steps = Array.isArray(data["assignments"]) ? data["assignments"].filter(isRecord3).length : 0;
   return { id: data["expert"]["id"], role: data["expert"]["role"] ?? null, plan: plan2, assigned_steps: steps };
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function bareClient(baseUrl, token, options) {
@@ -1564,6 +1747,22 @@ function interactive() {
   const ci = process.env["CI"];
   return process.stdout.isTTY === true && (ci === void 0 || ci === "");
 }
+function canConfirmRepoLogin() {
+  return process.stdin.isTTY === true && process.stderr.isTTY === true;
+}
+async function confirmRepoLogin(baseUrl, source, path) {
+  if (source !== "repo-config" || isHostTrusted(baseUrl)) return true;
+  const answer = await promptLine(
+    `This repo's config (${path ?? ".harness-cli/config.json"}) targets ${baseUrl} \u2014 log in there? [y/N] `
+  );
+  if (answer.trim().toLowerCase() !== "y") {
+    writeStderr(`harness: not logging in to ${baseUrl} \u2014 set HARNESS_API_URL to override the repo config
+`);
+    return false;
+  }
+  trustHost(baseUrl);
+  return true;
+}
 async function withConfig(jsonFlag, mutating, run2) {
   const resolved = resolveConfig();
   for (const warning of resolved.warnings) writeStderr(warning + "\n");
@@ -1575,22 +1774,14 @@ async function withConfig(jsonFlag, mutating, run2) {
   if (resolved.kind === "needs-login") {
     if (!interactive()) {
       writeStderr(loginHelp(resolved.baseUrl));
+      if (resolved.org !== void 0) writeStderr(`Choose organization ${resolved.org} when logging in.
+`);
       return exitWith(2);
     }
-    if (resolved.hostSource === "repo-config" && !isHostTrusted(resolved.baseUrl)) {
-      const answer = await promptLine(
-        `This repo's config (${resolved.repoConfigPath ?? ".harness-cli/config.json"}) targets ${resolved.baseUrl} \u2014 log in there? [y/N] `
-      );
-      if (answer.trim().toLowerCase() !== "y") {
-        writeStderr(
-          `harness: not logging in to ${resolved.baseUrl} \u2014 set HARNESS_API_URL to override the repo config
-`
-        );
-        return exitWith(2);
-      }
-      trustHost(resolved.baseUrl);
+    if (!await confirmRepoLogin(resolved.baseUrl, resolved.hostSource, resolved.repoConfigPath)) {
+      return exitWith(2);
     }
-    const loginResult = await login(resolved.baseUrl, {});
+    const loginResult = await login(resolved.baseUrl, resolved.org === void 0 ? {} : { org: resolved.org });
     if (!loginResult.ok) {
       writeStderr(`harness: ${clean(loginResult.message)}
 `);
@@ -1926,32 +2117,37 @@ plan.command("create").description("create a plan from a JSON or YAML file (the
     return planCreate(ctx, readPlanFile(opts.file), { ...opts, team: team2 });
   });
 });
-plan.command("show").description("a plan's status, budgets, revision, steps, edges and wait conditions").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+plan.command("list").description("a team's plans, newest first: root, status, held, revision and title").option("--team <key>", "the team whose issues root the plans (or HARNESS_TEAM)").option("--status <status>", PLAN_STATUSES.join(" | ")).option("--limit <n>", `maximum plans (default 50, at most ${PLAN_LIST_MAX_LIMIT}; there are no pages)`, integer).option("--json", "emit JSON").action(async (opts) => {
+  requirePlanListArgs(opts);
+  await withConfig(opts.json === true, false, (ctx) => planList(ctx, opts));
+});
+var PLAN_ARGUMENT = "the plan's id, or its root issue's identifier (e.g. FR-1)";
+plan.command("show").description("a plan's status, budgets, revision, steps, edges and wait conditions").argument("[plan]", PLAN_ARGUMENT).option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, false, (ctx) => {
-    if (id === void 0) throw new UsageError("usage: harness plan show <plan-id>");
+    if (id === void 0) throw new UsageError("usage: harness plan show <plan-id-or-root>");
     return planShow(ctx, id);
   });
 });
-plan.command("edit").description("change step executors and keys, and budgets, from a JSON or YAML file").argument("[id]").option("--file <path>", 'the edit: .json is JSON, anything else YAML ("-" for stdin)').option("--json", "emit JSON").action(async (id, opts) => {
+plan.command("edit").description("change step executors and keys, and budgets, from a JSON or YAML file").argument("[plan]", PLAN_ARGUMENT).option("--file <path>", 'the edit: .json is JSON, anything else YAML ("-" for stdin)').option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => {
     if (id === void 0 || opts.file === void 0) {
-      throw new UsageError("usage: harness plan edit <plan-id> --file <edits.json|edits.yaml>");
+      throw new UsageError("usage: harness plan edit <plan-id-or-root> --file <edits.json|edits.yaml>");
     }
-    requirePlanId(id);
+    requirePlanRef(id);
     return planEdit(ctx, id, readPlanFile(opts.file));
   });
 });
-plan.command("release").description("release a plan as yourself: freeze its next revision and let its ready steps run").argument("[id]").option("--collaborator <who>", "a person of this organization (id or email) for the plan room (repeatable)", collect, []).option("--retry-budget <n>", "retries per failed Operator step", integer).option("--spend-budget-cents <n>", "the plan's spend budget; needed to release Operator steps", integer).option("--json", "emit JSON").action(
+plan.command("release").description("release a plan as yourself: freeze its next revision and let its ready steps run").argument("[plan]", PLAN_ARGUMENT).option("--collaborator <who>", "a person of this organization (id or email) for the plan room (repeatable)", collect, []).option("--retry-budget <n>", "retries per failed Operator step", integer).option("--spend-budget-cents <n>", "the plan's spend budget; needed to release Operator steps", integer).option("--json", "emit JSON").action(
   async (id, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
-      if (id === void 0) throw new UsageError("usage: harness plan release <plan-id>");
+      if (id === void 0) throw new UsageError("usage: harness plan release <plan-id-or-root>");
       return planRelease(ctx, id, { ...opts, collaborators: opts.collaborator });
     });
   }
 );
-plan.command("hold").description("pause every step of a plan until it is released again").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+plan.command("hold").description("pause every step of a plan until it is released again").argument("[plan]", PLAN_ARGUMENT).option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => {
-    if (id === void 0) throw new UsageError("usage: harness plan hold <plan-id>");
+    if (id === void 0) throw new UsageError("usage: harness plan hold <plan-id-or-root>");
     return planHold(ctx, id);
   });
 });
@@ -2347,15 +2543,15 @@ link.command("rm").argument("[issue]").argument("[id-or-url]").option("--json",
     });
   }
 );
-var label = program.command("label").description("labels");
-label.command("list").option("--json", "emit JSON").action(async (opts) => {
+var label2 = program.command("label").description("labels");
+label2.command("list").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
     (ctx) => labelList(ctx)
   );
 });
-label.command("create").argument("[name]").option("--color <color>", "label color").option("--json", "emit JSON").action(
+label2.command("create").argument("[name]").option("--color <color>", "label color").option("--json", "emit JSON").action(
   async (name, opts) => {
     await withConfig(
       opts.json === true,
@@ -2364,10 +2560,10 @@ label.command("create").argument("[name]").option("--color <color>", "label colo
     );
   }
 );
-label.command("update").description("rename or recolor a label").argument("[id]").option("--name <name>", "new name").option("--color <color>", "swatch name (red, blue, \u2026) or a hex code").option("--json", "emit JSON").action(async (id, opts) => {
+label2.command("update").description("rename or recolor a label").argument("[id]").option("--name <name>", "new name").option("--color <color>", "swatch name (red, blue, \u2026) or a hex code").option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => labelUpdate(ctx, id, opts));
 });
-label.command("delete").description("delete a label (refused while issues carry it)").argument("[id]").option("--yes", "confirm the deletion").option("--json", "emit JSON").action(async (id, opts) => {
+label2.command("delete").description("delete a label (refused while issues carry it)").argument("[id]").option("--yes", "confirm the deletion").option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => labelDelete(ctx, id, opts));
 });
 var team = program.command("team").description("teams");
@@ -2478,7 +2674,7 @@ program.command("skills").description("the organization's skills assigned to Ope
   await withConfig(opts.json === true, false, (ctx) => skillsList(ctx));
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-KVRQBVXI.js");
+  const { startMcpServer } = await import("./server-F6YRKNC2.js");
   await startMcpServer(invokedAs);
 });
 var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
@@ -2500,6 +2696,17 @@ keys.command("exec").description(
     (ctx) => exec(ctx, { command, override: opts.override === true, only })
   );
 });
+var review = program.command("review").description("a pull request's enforced Review Council gate, and a retry of its latest attempt");
+review.command("status").description("the gate's enforced and advisory status, and a failed latest attempt with what comes next").argument("<pr>", "owner/repo#<pr>, the pull request URL, or <pr> with --repo or this checkout's origin").option("--repo <owner/repo>", "the repository a bare pull request number belongs to").option("--json", "emit JSON").action(async (pr, opts) => {
+  const ref = parsePullRequest(pr, opts.repo);
+  await withConfig(opts.json === true, false, (ctx) => status(ctx, ref));
+});
+review.command("retry").description(
+  "retry the latest gate attempt of the pull request's current head (needs reviews:write); the head, check and attempt are read from the gate status"
+).argument("<pr>", "owner/repo#<pr>, the pull request URL, or <pr> with --repo or this checkout's origin").option("--repo <owner/repo>", "the repository a bare pull request number belongs to").option("--reason <text>", "why the attempt is retried, recorded with it").option("--json", "emit JSON").action(async (pr, opts) => {
+  const ref = parsePullRequest(pr, opts.repo);
+  await withConfig(opts.json === true, true, (ctx) => retry(ctx, ref, opts.reason));
+});
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(
   "--timeout <ms>",
   "how long to wait for the browser callback",
@@ -2510,20 +2717,36 @@ program.command("login").description("sign in via the browser (infra.one session
     for (const warning of repoLookup.warnings)
       writeStderr(warning + "\n");
     const repoUrl = repoLookup.config?.url;
-    const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
+    const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? (repoLookup.config?.org === void 0 ? storedLoginUrl() : void 0) ?? DEFAULT_BASE_URL;
     if (url === repoUrl && opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0) {
       writeStderr(
         `harness: host ${url} comes from ${repoLookup.config?.path}
 `
       );
     }
+    const repoSelected = opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0 && repoUrl !== void 0;
+    if (repoSelected && !isHostTrusted(url)) {
+      if (!canConfirmRepoLogin()) {
+        writeStderr("harness: cannot confirm a repo-selected host without a terminal \u2014 pass --url explicitly\n");
+        return exitWith(2);
+      }
+      if (!await confirmRepoLogin(url, "repo-config", repoLookup.config?.path)) return exitWith(2);
+    }
     const options = { noBrowser: !opts.browser };
+    if (repoLookup.config?.org !== void 0) options.org = repoLookup.config.org;
     if (opts.timeout !== void 0) options.timeoutMs = opts.timeout;
     await finishAuth(await login(url, options), opts.json === true);
   }
 );
 program.command("logout").description("revoke and forget the stored login").option("--json", "emit JSON").action(async (opts) => {
-  await finishAuth(await logout(), opts.json === true);
+  const selected = resolveConfig({ ...process.env, HARNESS_API_TOKEN: void 0 });
+  if (selected.kind === "error") {
+    writeStderr(`harness: ${selected.message}
+`);
+    return exitWith(2);
+  }
+  const path = selected.kind === "ok" ? selected.config.credentialsPath : selected.credentialsPath;
+  await finishAuth(await logout(path === void 0 ? {} : { credentialsPath: path }), opts.json === true);
 });
 program.command("whoami").description("show the resolved host and credential source").option("--json", "emit JSON").action(async (opts) => {
   const resolved = resolveConfig();
@@ -2536,6 +2759,8 @@ program.command("whoami").description("show the resolved host and credential sou
   }
   if (resolved.kind === "needs-login") {
     writeStderr(loginHelp(resolved.baseUrl));
+    if (resolved.org !== void 0) writeStderr(`Choose organization ${resolved.org} when logging in.
+`);
     return exitWith(2);
   }
   const source = blankToUndefined(process.env["HARNESS_API_TOKEN"]) !== void 0 ? "environment" : "stored login";