@allocator-one/harness-cli 1.15.1 → 1.17.0

package/dist/cli.js

@@ -1,55 +1,44 @@
 #!/usr/bin/env node
+import {
+  UPDATE_CHECK_COMMAND,
+  guardBrokenPipes,
+  operatorDeprecationNotice,
+  performUpdateCheck,
+  selfHeal,
+  updateCheck
+} from "./chunk-A4WZAC7L.js";
 import {
   ACTIVITY_MAX_LIMIT,
-  Client,
-  CommandError,
-  DEFAULT_BASE_URL,
   EXIT_INTERRUPTED,
   EXIT_JOB_ENDED,
   EXIT_WAITING_FOR_PERSON,
-  EXPERT_ASSIGNMENTS_PATH,
-  EXPERT_LAPSED,
-  HttpError,
   JOBS_MAX_LIMIT,
   JOBS_MAX_PAGES,
   JOB_STATES,
-  LocalError,
+  PLAN_LIST_MAX_LIMIT,
+  PLAN_STATUSES,
   RELATION_CREATE_TYPES,
   RELATION_UPDATE_TYPES,
-  SESSION_PATH,
   STEER_MAX_CHARACTERS,
-  TransportError,
-  UpgradeRequiredError,
-  UsageError,
   activity,
   archive,
   assignments,
   attachImage,
   blocked,
-  clean,
   close,
   comment,
   comments,
   conditionList,
   create,
-  defaultCredentialsPath,
   deleteComment,
-  deleteCredentials,
   dep,
   docCreate,
   docList,
   docShow,
   docUpdate,
   editComment,
-  errorDetails,
-  expertSummary,
-  explainExpertRefusal,
-  findRepoConfig,
   gateSet,
   instructionFrom,
-  isExpertToken,
-  isHostTrusted,
-  isLoginCredential,
   jobCancel,
   jobContinue,
   jobPause,
@@ -57,7 +46,6 @@ import {
   jobSteer,
   jobWatch,
   jobsList,
-  json,
   labelCreate,
   labelDelete,
   labelList,
@@ -67,7 +55,6 @@ import {
   linkRm,
   linkUpdate,
   list,
-  loginHelp,
   memberAdd,
   memberList,
   memberSetRole,
@@ -76,6 +63,7 @@ import {
   planCreate,
   planEdit,
   planHold,
+  planList,
   planRelease,
   planShow,
   prepareProcedureRun,
@@ -87,7 +75,6 @@ import {
   projectList,
   projectShow,
   projectUpdate,
-  readCredentials,
   readPlanFile,
   ready,
   relationAdd,
@@ -100,7 +87,8 @@ import {
   requireIdentifiers,
   requireJobId,
   requireJobsArgs,
-  requirePlanId,
+  requirePlanListArgs,
+  requirePlanRef,
   requireProcedureId,
   requireProcedureName,
   requireReadyClaimArgs,
@@ -108,8 +96,6 @@ import {
   requireSearchQuery,
   requireToolsOpts,
   requiredTeam,
-  resolveCacheHome,
-  resolveConfig,
   resolveTextSources,
   run,
   search,
@@ -129,27 +115,50 @@ import {
   toolsDomains,
   toolsList,
   toolsSearch,
-  trustHost,
   update,
   upload,
   userList,
-  validateBaseUrl,
   validateIdempotencyKey,
   version,
   watchStopSignal,
-  workflowStates,
-  writeCredentials
-} from "./chunk-L2OWOZ4N.js";
+  workflowStates
+} from "./chunk-CEEQW6ZV.js";
+import {
+  login,
+  logout,
+  whoami
+} from "./chunk-WSDFLMO6.js";
+import {
+  Client,
+  CommandError,
+  DEFAULT_BASE_URL,
+  HttpError,
+  LocalError,
+  TransportError,
+  UpgradeRequiredError,
+  UsageError,
+  clean,
+  defaultCredentialsPath,
+  errorDetails,
+  explainExpertRefusal,
+  findRepoConfig,
+  isHostTrusted,
+  json,
+  loginHelp,
+  readCredentials,
+  resolveCacheHome,
+  resolveConfig,
+  trustHost
+} from "./chunk-BHBEIT5I.js";
 import {
   CLI_VERSION,
-  OPERATOR_PACKAGE,
   invokedName,
   layoutOperatorHelp,
   named
-} from "./chunk-FQWV5MIC.js";
+} from "./chunk-5THYIKLW.js";
 
 // src/cli.ts
-import { createInterface as createInterface2 } from "readline";
+import { createInterface } from "readline";
 import { Command, CommanderError, InvalidArgumentError } from "commander";
 
 // src/commands/keys.ts
@@ -203,9 +212,9 @@ function selectSlugs(stored, only) {
 function unknownSlugs(only) {
   return only.map((slug) => slug.trim()).filter((slug) => slug !== "" && !KEY_ENV_VARS.has(slug.toLowerCase()));
 }
-function withholdOthers(base, requested) {
+function withholdOthers(base2, requested) {
   const keep = new Set(requested.map((slug) => envVarFor(slug)));
-  const env = { ...base };
+  const env = { ...base2 };
   for (const name of KEY_ENV_VARS.values()) {
     if (!keep.has(name)) delete env[name];
   }
@@ -223,9 +232,9 @@ function toEnv(stored) {
   }
   return env;
 }
-function childEnv(base, fetched, override) {
+function childEnv(base2, fetched, override) {
   const env = {};
-  for (const [name, value] of Object.entries(base)) {
+  for (const [name, value] of Object.entries(base2)) {
     if (value !== void 0) env[name] = value;
   }
   for (const [name, value] of Object.entries(fetched)) {
@@ -234,8 +243,8 @@ function childEnv(base, fetched, override) {
   }
   return env;
 }
-function exitCodeFor(code, signal) {
-  if (code !== null) return code;
+function exitCodeFor(code2, signal) {
+  if (code2 !== null) return code2;
   if (signal !== null) {
     const number = constants.signals[signal];
     if (typeof number === "number") return 128 + number;
@@ -289,13 +298,13 @@ async function exec(ctx, opts) {
     opts.override
   );
   const name = clean(program2);
-  const exitCode = await new Promise((resolve, reject) => {
+  const exitCode = await new Promise((resolve3, reject) => {
     let child;
     try {
       child = spawn(program2, args, { stdio: "inherit", env });
     } catch (error) {
-      const code = error.code ?? "invalid arguments";
-      reject(new CommandError(`cannot start ${name}: ${code}`));
+      const code2 = error.code ?? "invalid arguments";
+      reject(new CommandError(`cannot start ${name}: ${code2}`));
       return;
     }
     const handlers = [];
@@ -325,1192 +334,1834 @@ async function exec(ctx, opts) {
     });
     child.on("error", (error) => {
       settle(() => {
-        const code = error.code ?? error.message;
-        reject(new CommandError(spawned ? `${name} failed: ${code}` : `cannot run ${name}: ${code}`));
+        const code2 = error.code ?? error.message;
+        reject(new CommandError(spawned ? `${name} failed: ${code2}` : `cannot run ${name}: ${code2}`));
       });
     });
-    child.on("exit", (code, signal) => {
-      settle(() => resolve(exitCodeFor(code, signal)));
+    child.on("exit", (code2, signal) => {
+      settle(() => resolve3(exitCodeFor(code2, signal)));
     });
   });
   return { json: { exit_code: exitCode }, human: "", exitCode };
 }
 
-// src/core/auth.ts
-import { createHash, randomBytes } from "crypto";
-import { execFile } from "child_process";
-import { accessSync, constants as fsConstants } from "fs";
-import { createServer } from "http";
-import { delimiter, join } from "path";
-import { createInterface } from "readline";
-var DEFAULT_TIMEOUT_MS = 18e4;
-var RESPONSE_DRAIN_GRACE_MS = 100;
-var RESPONSE_FLUSH_TIMEOUT_MS = 2e3;
-var MAX_PAGE_RESPONSES = 4;
-var loginPageImport;
-function loadLoginPage() {
-  loginPageImport ??= import("./login-page-KGEJFFXR.js");
-  return loginPageImport;
-}
-var NO_SESSION = { kind: null, expires_at: null, scopes: null, user: null, org: null };
-function generateState() {
-  return randomBytes(24).toString("base64url");
-}
-function generateVerifier() {
-  return randomBytes(32).toString("base64url");
-}
-function challengeFor(verifier) {
-  return createHash("sha256").update(verifier).digest("base64url");
-}
-async function login(baseUrl, options = {}) {
-  const validated = validateBaseUrl(baseUrl);
-  if (!validated.ok) return { ok: false, message: validated.message };
-  const base = baseUrl.replace(/\/+$/, "");
-  if (options.noBrowser === true || !browserAvailable(options)) {
-    return manualLogin(base, options);
-  }
-  return loopbackLogin(base, options);
-}
-function browserAvailable(options) {
-  if ("openBrowser" in options) return typeof options.openBrowser === "function";
-  return browserOpener() !== null && displayAvailable(options.env ?? process.env);
-}
-function findExecutable(name, pathVar = process.env["PATH"]) {
-  for (const dir of (pathVar ?? "").split(delimiter)) {
-    if (dir === "") continue;
-    const candidate = join(dir, name);
-    try {
-      accessSync(candidate, fsConstants.X_OK);
-      return candidate;
-    } catch {
-    }
-  }
-  return null;
-}
-function browserOpener() {
-  const name = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
-  if (name === null) return null;
-  return findExecutable(name);
-}
-function displayAvailable(env) {
-  const display = env["DISPLAY"];
-  const remote = isSet(env["SSH_CONNECTION"]) || isSet(env["SSH_TTY"]);
-  const hasDisplay = isSet(display) || isSet(env["WAYLAND_DISPLAY"]);
-  const forwarded = typeof display === "string" && display.startsWith("localhost:");
-  if (process.platform === "darwin") return !remote;
-  if (process.platform === "linux") return hasDisplay && (!remote || forwarded);
-  return !remote;
-}
-function isSet(value) {
-  return value !== void 0 && value !== "";
-}
-async function loopbackLogin(baseUrl, options) {
-  const notify = options.notify ?? defaultNotify;
-  const state2 = generateState();
-  const verifier = generateVerifier();
-  const challenge = challengeFor(verifier);
-  const server = createServer();
-  const port = await new Promise((resolve) => {
-    server.once("error", () => resolve(null));
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      resolve(typeof address === "object" && address !== null ? address.port : null);
-    });
-  });
-  if (port === null) {
-    return {
-      ok: false,
-      message: "could not open a loopback port for the browser handoff"
-    };
-  }
-  try {
-    const query = new URLSearchParams({ port: String(port), state: state2, challenge });
-    const url = `${baseUrl}/cli/login?${query.toString()}`;
-    const callbackPromise = awaitCallback(server, state2, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-    void loadLoginPage().catch(() => {
-      loginPageImport = void 0;
-    });
-    const openBrowser = options.openBrowser ?? defaultOpenBrowser;
-    try {
-      openBrowser(url);
-    } catch (error) {
-      const detail = error instanceof Error ? error.message : String(error);
-      return { ok: false, message: `could not open a browser: ${detail}` };
-    }
-    notify(`Opening ${url}`);
-    notify("Waiting for the browser authorization (Ctrl-C to abort)\u2026");
-    const callback = await callbackPromise;
-    if (!callback.ok) return callback;
-    try {
-      const token = await exchangeCode(baseUrl, callback.code, verifier, options);
-      if (!token.ok) {
-        await callback.respond(
-          400,
-          "Harness could not exchange the browser authorization. Return to the terminal for details.",
-          "error"
-        );
-        return token;
-      }
-      const result = await verifyAndStore(baseUrl, token.token, options, { minted: true, kind: token.kind });
-      if (result.ok) {
-        await callback.respond(200, "You can close this browser and return to the terminal.", "success");
-      } else {
-        await callback.respond(
-          400,
-          "Harness could not verify and store this login. Return to the terminal for details.",
-          "error"
-        );
-      }
-      return result;
-    } catch (error) {
-      await callback.respond(500, "Harness could not finish the login. Return to the terminal for details.", "error");
-      const detail = error instanceof Error ? error.message : String(error);
-      return { ok: false, message: `could not finish the browser login: ${detail}` };
-    }
-  } finally {
-    server.close();
-    const forceClose = setTimeout(
-      () => server.closeAllConnections(),
-      RESPONSE_FLUSH_TIMEOUT_MS + RESPONSE_DRAIN_GRACE_MS
-    );
-    forceClose.unref();
-  }
-}
-function awaitCallback(server, state2, timeoutMs) {
-  return new Promise((resolve) => {
-    let phase = "waiting";
-    let finalResponse = null;
-    let callbackPageResponses = 0;
-    const rootPageResponses = /* @__PURE__ */ new Map();
-    const acceptedResponders = [];
-    const inFlightResponses = /* @__PURE__ */ new Set();
-    const trackResponse = (responsePromise) => {
-      inFlightResponses.add(responsePromise);
-      void responsePromise.finally(() => inFlightResponses.delete(responsePromise));
-      return responsePromise;
-    };
-    const drainTrackedResponses = async () => {
-      await new Promise((settle) => setTimeout(settle, RESPONSE_DRAIN_GRACE_MS));
-      const deadline = Date.now() + RESPONSE_FLUSH_TIMEOUT_MS;
-      while (inFlightResponses.size > 0 && Date.now() < deadline) {
-        const remaining = deadline - Date.now();
-        await Promise.race([
-          Promise.allSettled([...inFlightResponses]),
-          new Promise((settle) => setTimeout(settle, remaining))
-        ]);
-      }
-    };
-    const timer = setTimeout(() => {
-      if (phase !== "waiting") return;
-      const timeoutResponse = {
-        status: 410,
-        message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
-        pageState: "error"
-      };
-      phase = "terminal";
-      finalResponse = timeoutResponse;
-      resolve({
-        ok: false,
-        message: "timed out waiting for the browser authorization"
-      });
-      void drainTrackedResponses();
-    }, timeoutMs);
-    server.once("close", () => {
-      clearTimeout(timer);
-      if (phase !== "waiting") return;
-      phase = "terminal";
-      resolve({ ok: false, message: "the browser login listener closed before authorization completed" });
-    });
-    server.on("request", (request, response) => {
-      const respond = callbackResponder(response);
-      const respondWithPage = (status, message, pageState) => {
-        if (callbackPageResponses >= MAX_PAGE_RESPONSES) {
-          respondEmpty(response, 429);
-          return Promise.resolve();
-        }
-        callbackPageResponses += 1;
-        return respond(status, message, pageState);
-      };
-      const respondAtRoot = (status, message, pageState) => {
-        const rootPhase = phase === "terminal" ? "terminal" : "waiting";
-        const responses = rootPageResponses.get(rootPhase) ?? 0;
-        if (responses >= MAX_PAGE_RESPONSES) {
-          respondEmpty(response, 429);
-          return Promise.resolve();
-        }
-        rootPageResponses.set(rootPhase, responses + 1);
-        return respond(status, message, pageState);
-      };
-      let url;
-      try {
-        url = new URL(request.url ?? "/", "http://127.0.0.1");
-      } catch {
-        respondEmpty(response, 404);
-        return;
-      }
-      const path = url.pathname.replace(/\/+$/, "") || "/";
-      if (path !== "/callback") {
-        if (path === "/") {
-          const rootResponse = phase === "terminal" && finalResponse ? finalResponse : {
-            status: 200,
-            message: "Waiting for the Harness browser authorization to finish.",
-            pageState: "waiting"
-          };
-          void trackResponse(
-            respondAtRoot(rootResponse.status, rootResponse.message, rootResponse.pageState)
-          );
-        } else {
-          respondEmpty(response, path === "/favicon.ico" ? 204 : 404);
-        }
-        return;
-      }
-      const matchingState = url.searchParams.get("state") === state2;
-      if (!matchingState) {
-        respondEmpty(response, 400);
-        return;
-      }
-      if (phase === "terminal") {
-        if (!url.searchParams.has("code") && !url.searchParams.has("error")) {
-          respondEmpty(response, 400);
-          return;
-        }
-        const result = finalResponse ?? {
-          status: 410,
-          message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
-          pageState: "error"
-        };
-        void trackResponse(respondWithPage(result.status, result.message, result.pageState));
-        return;
-      }
-      if (phase === "processing") {
-        if (url.searchParams.has("error")) {
-          respondEmpty(response, 409);
-          return;
-        }
-        const duplicateCode = url.searchParams.get("code");
-        if (duplicateCode === null || duplicateCode === "") {
-          respondEmpty(response, 400);
-          return;
-        }
-        if (acceptedResponders.length >= MAX_PAGE_RESPONSES) {
-          respondEmpty(response, 429);
-          return;
-        }
-        acceptedResponders.push(respondWithPage);
-        return;
-      }
-      if (url.searchParams.has("error")) {
-        const denialResponse = {
-          status: 400,
-          message: "Browser authorization was denied. Return to the terminal to try again.",
-          pageState: "error"
-        };
-        phase = "terminal";
-        finalResponse = denialResponse;
-        clearTimeout(timer);
-        void (async () => {
-          await trackResponse(respondWithPage(denialResponse.status, denialResponse.message, denialResponse.pageState));
-          await drainTrackedResponses();
-          resolve({ ok: false, message: "browser authorization was denied" });
-        })();
-        return;
-      }
-      const code = url.searchParams.get("code");
-      if (code !== null && code !== "") {
-        phase = "processing";
-        acceptedResponders.push(respondWithPage);
-        clearTimeout(timer);
-        resolve({
-          ok: true,
-          code,
-          respond: async (status, message, pageState) => {
-            finalResponse = { status, message, pageState };
-            phase = "terminal";
-            const responders = acceptedResponders.splice(0);
-            await Promise.all(
-              responders.map((acceptedRespond) => trackResponse(acceptedRespond(status, message, pageState)))
-            );
-            await drainTrackedResponses();
-          }
-        });
-      } else {
-        respondEmpty(response, 400);
-      }
-    });
-  });
+// src/commands/review.ts
+import { execFileSync } from "child_process";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function callbackResponder(response) {
-  return async (status, message, state2) => {
-    if (response.writableEnded || response.destroyed) return;
-    return new Promise((resolve) => {
-      let flushTimer;
-      const armFlushTimeout = () => {
-        if (flushTimer !== void 0) clearTimeout(flushTimer);
-        flushTimer = setTimeout(() => {
-          response.destroy();
-          settle();
-        }, RESPONSE_FLUSH_TIMEOUT_MS);
-        flushTimer.unref();
-      };
-      const settle = () => {
-        if (flushTimer !== void 0) clearTimeout(flushTimer);
-        response.off("finish", settle);
-        response.off("close", settle);
-        response.off("error", settle);
-        response.off("drain", armFlushTimeout);
-        resolve();
-      };
-      response.once("finish", settle);
-      response.once("close", settle);
-      response.once("error", settle);
-      response.on("drain", armFlushTimeout);
-      void loadLoginPage().then(({ loginPage }) => {
-        if (response.writableEnded || response.destroyed) {
-          settle();
-          return;
-        }
-        try {
-          const html = loginPage(message, state2);
-          response.writeHead(status, {
-            "cache-control": "no-store",
-            connection: "close",
-            "content-length": String(Buffer.byteLength(html)),
-            "content-type": "text/html; charset=utf-8",
-            "x-content-type-options": "nosniff"
-          });
-          armFlushTimeout();
-          response.end(html);
-        } catch {
-          response.destroy();
-          settle();
-        }
-      }).catch(() => {
-        response.destroy();
-        settle();
-      });
-    });
-  };
+var SLUG = /^([\w.-]+)\/([\w.-]+)$/;
+function githubSlug(remote) {
+  const match = /^(?:(?:https?|ssh|git):\/\/(?:[^@/\s]+@)?|[\w.-]+@)github\.com[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/i.exec(remote.trim());
+  return match ? `${match[1]}/${match[2]}` : void 0;
 }
-function respondEmpty(response, status) {
-  response.once("error", () => void 0);
+function originRemote() {
   try {
-    response.writeHead(status, {
-      "cache-control": "no-store",
-      connection: "close",
-      "x-content-type-options": "nosniff"
-    });
-    response.end();
+    const url = execFileSync("git", ["remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return githubSlug(url);
   } catch {
-    response.destroy();
+    return void 0;
   }
 }
-async function exchangeCode(baseUrl, code, verifier, options) {
-  try {
-    const body = await bareClient(baseUrl, "", options).post("/api/v1/cli/token-exchange", { code, code_verifier: verifier });
-    const token = body.data?.token;
-    const kind = typeof body.data?.kind === "string" ? body.data.kind : null;
-    if (typeof token === "string" && token !== "") return { ok: true, token, kind };
-    return {
-      ok: false,
-      message: "the login-code exchange returned no token \u2014 aborting"
-    };
-  } catch (error) {
-    if (error instanceof HttpError) {
-      return {
-        ok: false,
-        message: `the login-code exchange failed: ${error.message}`
-      };
-    }
-    if (error instanceof TransportError) {
-      return {
-        ok: false,
-        message: `the login-code exchange failed: cannot reach the API (${error.message})`
-      };
-    }
-    throw error;
-  }
+function prNumber(digits, input) {
+  const number = Number(digits);
+  if (!Number.isSafeInteger(number) || number < 1) throw new UsageError(`not a pull request number: ${input}`);
+  return number;
 }
-async function manualLogin(baseUrl, options) {
-  const notify = options.notify ?? defaultNotify;
-  const prompt = options.prompt ?? defaultPrompt;
-  notify(
-    `Open ${baseUrl}/cli/login in a browser, authorize, and paste the token below (an outside expert pastes the pxc_ credential minted in their expert view instead).`
-  );
-  const token = (await prompt()).trim();
-  if (token === "") return { ok: false, message: "no token entered" };
-  return verifyAndStore(baseUrl, token, options, { minted: false, kind: null });
-}
-async function verifyAndStore(baseUrl, token, options, received) {
-  const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
-  const client = bareClient(baseUrl, token, options);
-  const expert = isExpertToken(token);
-  let kind = received.kind;
+var NAME = /^[\w.-]+$/;
+function fromUrl(input) {
+  let url;
   try {
-    if (expert) {
-      await client.get(EXPERT_ASSIGNMENTS_PATH);
-    } else {
-      const described = isLoginCredential(token) ? await describeSession(client) : null;
-      if (described === null) await client.get("/api/v1/teams");
-      else kind = described.session.kind ?? kind;
-    }
-  } catch (error) {
-    if (error instanceof HttpError) {
-      const lapsed = expert && error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : "";
-      const revoked = received.minted && await revokeSession(client, token);
-      return {
-        ok: false,
-        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored${revoked ? ", and the token was revoked" : ""}${lapsed}`
-      };
-    }
-    if (error instanceof TransportError) {
-      return {
-        ok: false,
-        message: `could not verify the token: cannot reach the API (${error.message}) \u2014 nothing was stored`
-      };
-    }
-    throw error;
+    url = new URL(input);
+  } catch {
+    return null;
   }
-  const stored = readCredentials(path);
-  const superseded = stored !== null && stored.token !== token ? stored : null;
+  if (!["https:", "http:"].includes(url.protocol) || !/^(www\.)?github\.com$/i.test(url.hostname)) return null;
+  let segments;
   try {
-    writeCredentials(path, baseUrl, token);
-  } catch (error) {
-    if (received.minted) await revokeSession(client, token);
-    const detail = error instanceof Error ? error.message : String(error);
-    return {
-      ok: false,
-      message: `could not store credentials at ${path}: ${detail}` + (expert ? " (the pxc_ credential is still valid: revoke it in your expert view)" : received.minted ? "" : " (the pasted token was not revoked and stays valid)")
-    };
+    segments = url.pathname.split("/").filter((segment) => segment !== "").map(decodeURIComponent);
+  } catch {
+    return null;
   }
-  let supersededNote = "";
-  if (superseded !== null) {
-    await revokeSession(bareClient(superseded.url, superseded.token, options), superseded.token);
-    if (isExpertToken(superseded.token)) {
-      supersededNote = "The pxc_ credential stored before stays valid until it expires: revoke it in your expert view.\n";
-    }
+  const [owner, repo, kind, number] = segments;
+  if (kind !== "pull" || !owner || !repo || !number || !NAME.test(owner) || !NAME.test(repo) || !/^\d+$/.test(number)) {
+    return null;
   }
-  const name = invokedName();
+  return [owner, repo, number];
+}
+function parsePullRequest(input, repo, origin = originRemote) {
+  const trimmed = input.trim();
+  const url = fromUrl(trimmed);
+  if (url) return { owner: url[0], repo: url[1], number: prNumber(url[2], input) };
+  const named2 = /^([\w.-]+)\/([\w.-]+)#(\d+)$/.exec(trimmed);
+  if (named2) return { owner: named2[1], repo: named2[2], number: prNumber(named2[3], input) };
+  const bare = /^#?(\d+)$/.exec(trimmed);
+  if (!bare) throw new UsageError(`not a pull request: ${input} \u2014 use owner/repo#<pr>, its URL, or <pr> with --repo`);
+  const slug = repo ?? origin();
+  const parts = slug === void 0 ? null : SLUG.exec(slug.trim());
+  if (!parts) throw new UsageError("name the repository: owner/repo#<pr>, the pull request URL, or --repo owner/repo");
+  return { owner: parts[1], repo: parts[2], number: prNumber(bare[1], input) };
+}
+var label = (pr) => `${pr.owner}/${pr.repo}#${pr.number}`;
+var gatePath = (pr) => `/api/v1/reviews/prs/${encodeURIComponent(pr.owner)}/${encodeURIComponent(pr.repo)}/${pr.number}`;
+async function fetchGate(ctx, pr) {
+  const body = await ctx.client.get(gatePath(pr));
+  if (!isRecord2(body.data)) throw new CommandError(`unexpected gate status for ${label(pr)}: no data`);
+  return body.data;
+}
+function latestAttempt(lifecycle) {
+  const attempts = Array.isArray(lifecycle["attempts"]) ? lifecycle["attempts"].filter(isRecord2) : [];
+  return attempts.reduce(
+    (latest, attempt) => latest === void 0 || Number(attempt["number"]) > Number(latest["number"]) ? attempt : latest,
+    void 0
+  );
+}
+function recovery(lifecycle) {
+  const latest = latestAttempt(lifecycle);
+  const sent = isRecord2(lifecycle["recovery"]) ? lifecycle["recovery"] : void 0;
+  const state2 = String(sent?.["state"] ?? latest?.["state"] ?? "");
+  if (state2 !== "failed" && state2 !== "timed_out") return void 0;
+  const reason = sent?.["terminal_reason"] ?? latest?.["terminal_reason"];
   return {
-    ok: true,
-    json: { url: baseUrl, credentials: path, kind },
-    human: (expert ? `Stored an outside expert's pxc_ credential for ${baseUrl} at ${path} (it lasts at most 30 days; revoke it in your expert view \u2014 ${name} logout only forgets it). Commands now act as the expert: only assignments, conditions and gate work until you log in again.
-` : `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; ${name} logout revokes it).
-`) + kindNote(kind) + supersededNote
+    number: latest?.["number"],
+    state: state2 === "timed_out" ? "timed out" : state2,
+    reason: typeof reason === "string" ? reason : null,
+    evidence: sent ? sent["evidence_recorded"] === true : latest?.["review_run_id"] != null,
+    next: sent?.["next"] === "automatic_retry" ? "automatic_retry" : "retry"
   };
 }
-function kindNote(kind) {
-  if (kind === "operator-cli") {
-    return "This credential is Operator-only (operator-cli): Operator commands work; issue, plan and gate commands are refused.\n";
+function describe(r) {
+  const why = [r.reason, r.evidence ? null : "no evidence recorded"].filter((part) => part !== null).join(", ");
+  return `attempt ${clean(String(r.number))} ${r.state}${why === "" ? "" : ` (${clean(why)})`}`;
+}
+function projection(gate2, key) {
+  const value = gate2[key];
+  return isRecord2(value) && typeof value["status"] === "string" ? clean(value["status"]) : "unknown";
+}
+async function status(ctx, pr) {
+  const gate2 = await fetchGate(ctx, pr);
+  const lifecycle = isRecord2(gate2["lifecycle"]) ? gate2["lifecycle"] : void 0;
+  const head = isRecord2(gate2["head"]) && typeof gate2["head"]["sha"] === "string" ? gate2["head"]["sha"].slice(0, 10) : "?";
+  const lines = [
+    `${label(pr)} at ${clean(head)}`,
+    `enforced: ${projection(gate2, "enforced")}   advisory: ${projection(gate2, "advisory")}`
+  ];
+  if (lifecycle) {
+    lines.push(`gate check: ${clean(String(lifecycle["state"] ?? "unknown")).replaceAll("_", " ")}`);
+    const r = recovery(lifecycle);
+    if (r) {
+      lines.push(`latest ${describe(r)}`);
+      lines.push(
+        r.next === "automatic_retry" ? "Harness retries it automatically; check again shortly." : named(`Retry it with: harness review retry ${label(pr)} --reason "\u2026"`)
+      );
+    }
   }
-  if (kind === "harness-cli") return "This credential has full access (harness-cli).\n";
-  return "";
-}
-async function describeSession(client) {
+  return { json: gate2, human: lines.join("\n") + "\n" };
+}
+var REFUSALS = {
+  execution_not_terminal: "the latest attempt is still running; wait for it to finish",
+  attempt_changed: "another attempt was created meanwhile; read the status and run this again",
+  check_changed: "the head's gate check changed meanwhile; run this again",
+  head_changed: "the pull request's head moved; the new head gets its own check",
+  advisory_not_converged: "the head's advisory review has not converged; converge it first",
+  retry_conflict: "this attempt was already retried with a different reason",
+  merged: "the pull request is merged"
+};
+async function retry(ctx, pr, reason) {
+  const gate2 = await fetchGate(ctx, pr);
+  const lifecycle = isRecord2(gate2["lifecycle"]) ? gate2["lifecycle"] : void 0;
+  if (!lifecycle || typeof lifecycle["check_id"] !== "string" || typeof lifecycle["head_sha"] !== "string") {
+    throw new CommandError(`${label(pr)} has no gate check at its current head: nothing to retry`);
+  }
+  const r = recovery(lifecycle);
+  if (r?.next === "automatic_retry") {
+    throw new CommandError(named(`Harness retries attempt ${clean(String(r.number))} itself; run harness review status ${label(pr)} shortly`));
+  }
+  const previous = latestAttempt(lifecycle);
+  const previousId = typeof previous?.["id"] === "string" ? previous["id"] : null;
+  const body = {
+    head_sha: lifecycle["head_sha"],
+    check_id: lifecycle["check_id"],
+    previous_attempt_id: previousId,
+    // One key per attempt retried: running this again for the same attempt returns the attempt already
+    // queued instead of paying for another review run.
+    request_key: `harness-cli:${previousId ?? lifecycle["check_id"]}`,
+    reason: reason?.trim() || "Retry requested with harness review retry"
+  };
+  let response;
   try {
-    const { envelope, apiVersion } = await client.getVersioned(SESSION_PATH);
-    return { session: sessionOf(envelope.data), apiVersion };
+    response = await ctx.client.post(`${gatePath(pr)}/retry`, body, { actor: false });
   } catch (error) {
-    if (error instanceof HttpError && (error.status === 404 || error.status === 405)) return null;
+    if (error instanceof HttpError && error.status === 409) {
+      const code2 = error.message.trim().split(/[\s:]+/).pop() ?? "";
+      throw new CommandError(`could not retry ${label(pr)}: ${REFUSALS[code2] ?? clean(error.message)}`);
+    }
+    if (error instanceof HttpError && error.status === 403) {
+      throw new CommandError(`${error.message} \u2014 a retry needs a login with reviews:write`);
+    }
     throw error;
   }
-}
-function sessionOf(data) {
-  if (!isRecord2(data)) return NO_SESSION;
-  const text = (value) => typeof value === "string" ? value : null;
+  const attempt = isRecord2(response.data) ? response.data : {};
+  const outcome = response["outcome"];
+  const verb = outcome === "existing" ? "Already queued" : "Queued";
   return {
-    kind: text(data["kind"]),
-    expires_at: text(data["expires_at"]),
-    scopes: Array.isArray(data["scopes"]) ? data["scopes"].filter((scope) => typeof scope === "string") : null,
-    user: isRecord2(data["user"]) ? data["user"] : null,
-    org: isRecord2(data["org"]) ? data["org"] : null
+    json: { attempt, outcome },
+    human: `${verb} attempt ${clean(String(attempt["number"]))} (${clean(String(attempt["id"]))}) for ${label(pr)}
+`
   };
 }
-async function revokeSession(client, token) {
-  if (isExpertToken(token)) return false;
-  return client.delete("/api/v1/session").then(() => true).catch(() => false);
-}
-async function logout(options = {}) {
-  const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
-  const stored = readCredentials(path);
-  if (stored === null) {
-    const envToken = (options.env ?? process.env)["HARNESS_API_TOKEN"] ?? "";
-    return {
-      ok: false,
-      message: "No stored login to remove. A HARNESS_API_TOKEN from the environment is yours to manage \u2014 " + (isExpertToken(envToken.trim()) ? "unset it, or revoke the pxc_ credential in your expert view." : "unset it, or disable the token in the admin UI.")
-    };
-  }
-  const expert = isExpertToken(stored.token);
-  const revoked = await revokeSession(bareClient(stored.url, stored.token, options), stored.token);
-  const note = revoked ? "" : " (server-side revoke failed \u2014 the token still expires on its own)";
+
+// src/commands/code/index.ts
+import { resolve as resolve2 } from "path";
+import { statSync } from "fs";
+
+// src/core/code/http.ts
+import { setTimeout as delay } from "timers/promises";
+import { z } from "zod";
+var UUID = z.string().uuid();
+var HASH = z.string().regex(/^[a-f0-9]{64}$/);
+var view = z.object({
+  view_id: UUID,
+  view_key: z.string(),
+  repository_id: UUID,
+  active: z.object({
+    version: z.number().int(),
+    base_commit: z.string(),
+    overlay_digest: HASH,
+    indexed_at: z.string().nullable().optional()
+  }).nullable(),
+  pending: z.object({
+    version: z.number().int(),
+    state: z.string(),
+    progress: z.object({ done: z.number().int().nonnegative(), total: z.number().int().nonnegative() }).nullable().optional(),
+    error: z.unknown().optional()
+  }).nullable()
+});
+var policy = z.object({
+  org_id: UUID,
+  policy_digest: z.string().min(1).max(256),
+  max_file_bytes: z.number().int().positive(),
+  max_batch_bytes: z.number().int().positive(),
+  include_extensions: z.array(z.string().max(32)).max(100),
+  deny_globs: z.array(z.string().max(1024)).max(1e3),
+  deny_glob_case: z.literal("ascii_insensitive").optional(),
+  content_patterns: z.array(z.string().max(4096)).max(100),
+  org_name: z.string().optional()
+});
+var base = z.object({
+  state: z.enum(["fetching", "complete", "ready", "failed"]),
+  policy_digest: z.string().optional(),
+  file_count: z.number().optional(),
+  excluded_count: z.number().optional(),
+  skipped: z.array(z.object({ path: z.string(), reason: z.string() })).optional(),
+  error: z.unknown().optional(),
+  retry_after_ms: z.number().nonnegative().optional()
+});
+var opened = z.object({
+  sync_id: UUID,
+  state: z.string(),
+  missing: z.array(HASH),
+  rejected: z.array(z.object({ path: z.string(), error: z.string() }))
+});
+var activated = z.object({
+  pending_version: z.number().int().positive(),
+  state: z.string()
+});
+var syncStatus = z.object({
+  id: UUID,
+  state: z.enum(["receiving", "queued", "indexing", "active", "superseded", "failed"]),
+  version: z.number().int().nonnegative().nullable()
+});
+function decode(schema, data) {
+  const result = schema.safeParse(data);
+  if (!result.success)
+    throw new CommandError(
+      "The code index API returned an invalid response; no additional source will be uploaded."
+    );
+  return result.data;
+}
+function retryAfterMs(value, now = Date.now()) {
+  if (value === null) return void 0;
+  const seconds = Number(value);
+  if (/^\d+(?:\.\d+)?$/.test(value) && Number.isFinite(seconds))
+    return seconds * 1e3;
+  const date = Date.parse(value);
+  return Number.isNaN(date) ? void 0 : Math.max(0, date - now);
+}
+function describeCodeError(error) {
+  const code2 = error.body["error"];
+  let message = error.message;
+  if (code2 === "repository_not_connected")
+    message = "repository_not_connected: share this repository through your organization\u2019s Harness GitHub connection before syncing.";
+  if (code2 === "code_index_disabled")
+    message = "code_index_disabled: code indexing is disabled for this organization; ask a Harness administrator to enable it.";
+  if (code2 === "quota_exceeded") {
+    const raw = error.body["details"];
+    const d = raw && typeof raw === "object" ? raw : {};
+    message = `quota_exceeded: your organization\u2019s code index limit ${typeof d["quota"] === "string" ? d["quota"] : "quota"} is reached (limit ${typeof d["limit"] === "number" ? d["limit"] : "unknown"}). Ask a Harness administrator.`;
+  }
+  if (code2 === "invalid_sync")
+    message = "invalid_sync: the client sync request does not match the server contract. Upgrade the client and retry code sync.";
+  if (code2 === "overlay_too_large") {
+    const raw = error.body["details"];
+    const details = raw && typeof raw === "object" ? raw : {};
+    const limit = typeof details["limit"] === "number" ? details["limit"] : 2e4;
+    message = `overlay_too_large: the overlay exceeds ${limit} paths. Sync against a newer base commit.`;
+  }
+  if (code2 === "unexpected_blob")
+    message = "unexpected_blob: no open sync names this upload. Retry code sync to reconcile the overlay; base blobs are never uploaded.";
+  if (code2 === "stale_policy")
+    message = "stale_policy: the upload policy kept changing; retry code sync to fetch the policy and rescan.";
+  if (code2 === "not_view_owner")
+    message = "not_view_owner: this code view belongs to another member; sync your own worktree.";
+  if (code2 === "insufficient_scope" || code2 === "missing_scope")
+    message = "Code commands need harness:read; sync and base status also need harness:write.";
+  return new HttpError(error.status, message, error.body, error.retryAfter);
+}
+async function responseText(response, maxBytes) {
+  if (maxBytes === void 0) return response.text();
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
   try {
-    deleteCredentials(path);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return {
-      ok: false,
-      message: `could not remove ${path} (${detail}) \u2014 delete it manually.` + (revoked ? " The token itself was revoked." : "")
-    };
+    while (true) {
+      const part = await reader.read();
+      if (part.done) break;
+      size += part.value.byteLength;
+      if (size > maxBytes) {
+        void reader.cancel().catch(() => {
+        });
+        throw new CommandError("The code query response exceeds the 16 MiB size limit; narrow the query.");
+      }
+      chunks.push(Buffer.from(part.value));
+    }
+  } finally {
+    reader.releaseLock();
   }
-  return {
-    ok: true,
-    json: { logged_out: true, revoked },
-    human: expert ? `Forgot the outside expert's pxc_ credential for ${stored.url}. It stays valid until it expires: revoke it in your expert view to end it now.
-` : `Logged out of ${stored.url}${note}.
-`
-  };
-}
-async function whoami(config, credentialSource) {
-  const client = new Client(config);
-  const expert = isExpertToken(config.token);
-  let probe;
-  let session = null;
-  let serverVersion;
   try {
-    const described2 = isLoginCredential(config.token) ? await describeSession(client) : null;
-    if (described2 !== null) {
-      session = described2.session;
-      serverVersion = described2.apiVersion;
-    } else {
-      const answered = await client.getVersioned(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats");
-      probe = answered.envelope.data;
-      serverVersion = answered.apiVersion;
+    return new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+  } catch {
+    throw new CommandError("The code query response is not valid UTF-8.");
+  }
+}
+var HttpCodeApi = class {
+  constructor(config, options = {}) {
+    this.config = config;
+    this.origin = config.baseUrl;
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+    this.sleep = options.sleep ?? delay;
+  }
+  config;
+  origin;
+  fetchImpl;
+  sleep;
+  async request(method, path, body, maxResponseBytes) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        const headers = {
+          authorization: `Bearer ${this.config.token}`,
+          "x-harness-cli-version": CLI_VERSION
+        };
+        const encoded = body === void 0 ? void 0 : Buffer.isBuffer(body) ? body : JSON.stringify(body);
+        if (body !== void 0)
+          headers["content-type"] = Buffer.isBuffer(body) ? "application/octet-stream" : "application/json";
+        const response = await this.fetchImpl(
+          new URL(this.origin + "/api/v1/code" + path),
+          {
+            method,
+            headers,
+            body: encoded,
+            signal: AbortSignal.timeout(3e4),
+            redirect: "manual"
+          }
+        );
+        const retryAfter = retryAfterMs(response.headers.get("retry-after"));
+        const text = await responseText(response, maxResponseBytes);
+        let json2 = {};
+        if (text) {
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
+              json2 = parsed;
+            else if (response.ok)
+              throw new CommandError(
+                "The code index API returned an invalid JSON envelope."
+              );
+          } catch (error) {
+            if (response.ok)
+              throw error instanceof CommandError ? error : new CommandError(
+                "The code index API returned a non-JSON body."
+              );
+          }
+        }
+        if (!response.ok) {
+          const message = typeof json2["message"] === "string" ? json2["message"] : `Code index request refused (HTTP ${response.status}).`;
+          if (response.status === 426)
+            throw new UpgradeRequiredError(message, json2);
+          throw new HttpError(
+            response.status,
+            message,
+            json2,
+            response.headers.get("retry-after")
+          );
+        }
+        return { data: json2["data"], meta: json2["meta"], retryAfter };
+      } catch (error) {
+        if (error instanceof UpgradeRequiredError || error instanceof CommandError)
+          throw error;
+        const transient = error instanceof HttpError ? [429, 500, 502, 503, 504].includes(error.status) : true;
+        if (!transient || attempt === 2) {
+          if (error instanceof HttpError) throw error;
+          throw new TransportError(
+            "Code index request did not complete. Retry this command with the same worktree to resume."
+          );
+        }
+        const backoff = error instanceof HttpError ? retryAfterMs(error.retryAfter) : void 0;
+        const wait = backoff ?? 250 * 2 ** attempt;
+        if (wait > 3e5)
+          throw error instanceof HttpError ? error : new TransportError(
+            "The code index retry backoff is too long; retry later."
+          );
+        await this.sleep(wait);
+      }
     }
-  } catch (error) {
-    if (error instanceof HttpError) {
-      return {
-        ok: false,
-        message: expert ? `signed in to ${config.baseUrl} with an outside expert's pxc_ credential (${credentialSource}), but it was refused: ${error.message} (HTTP ${error.status})${error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : ""}` : `signed in to ${config.baseUrl} with a ${credentialSource} credential, but it failed verification: ${error.message} (HTTP ${error.status})`
-      };
+    throw new CommandError("Code index retry limit exceeded.");
+  }
+  async query(id, operation, p) {
+    const root = `/views/${encodeURIComponent(id)}`;
+    if (operation === "affected") {
+      const result2 = await this.request("POST", root + "/affected", {
+        symbol_ids: p.symbols ?? [],
+        paths: p.files ?? [],
+        ...p.depth !== void 0 ? { depth: p.depth } : {},
+        ...p.includeAmbiguous !== void 0 ? { include_ambiguous: p.includeAmbiguous } : {},
+        ...p.includeTypes !== void 0 ? { include_types: p.includeTypes } : {}
+      }, 16 * 1024 * 1024);
+      return { data: result2.data, meta: result2.meta };
     }
-    throw error;
-  }
-  let seat = null;
-  if (expert) {
-    seat = expertSeat(probe);
-    if (seat === null) {
-      return {
-        ok: false,
-        message: `signed in to ${config.baseUrl} with an outside expert's pxc_ credential, but the assignments response carried no expert`
-      };
+    const path = operation === "explain" ? root + `/symbols/${encodeURIComponent(p.symbol)}` : root + (operation === "search" ? "/symbols" : "/context");
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(operation === "search" ? { q: p.q, kind: p.kind, path_prefix: p.pathPrefix, limit: p.limit } : operation === "explain" ? { budget_tokens: p.budgetTokens } : { q: p.q, symbol_id: p.symbol, budget_tokens: p.budgetTokens })) {
+      if (value !== void 0) params.set(key, String(value));
     }
+    const result = await this.request("GET", path + (params.size ? "?" + params.toString() : ""), void 0, 16 * 1024 * 1024);
+    return { data: result.data, meta: result.meta };
   }
-  serverVersion ??= "unknown";
-  const hostSourceLabels = {
-    env: "HARNESS_API_URL",
-    "repo-config": ".harness-cli/config.json",
-    "stored-login": "stored login",
-    default: "workspace default"
-  };
-  const via = config.hostSource !== void 0 ? ` (via ${hostSourceLabels[config.hostSource]})` : "";
-  const expertLines = seat === null ? "" : `Expert:      ${expertSummary(seat)}
-Reaches:     its own assignments and the gates it owns on them (assignments, conditions, gate)
-`;
-  const described = session ?? NO_SESSION;
-  return {
-    ok: true,
-    json: {
-      url: config.baseUrl,
-      source: credentialSource,
-      verified: true,
-      server_version: serverVersion,
-      host_source: config.hostSource,
-      kind: described.kind,
-      expires_at: described.expires_at,
-      scopes: described.scopes,
-      user: described.user,
-      org: described.org,
-      expert: seat
-    },
-    human: `Host:        ${config.baseUrl}${via}
-Credential:  ${credentialSource}${seat === null ? "" : ", an outside expert's pxc_ credential"}${kindLabel(described.kind)}
-` + sessionLines(described) + expertLines + `Verified:    ok (server API ${serverVersion})
-`
-  };
-}
-function kindLabel(kind) {
-  if (kind === null) return "";
-  if (kind === "harness-cli") return ", harness-cli (full access)";
-  if (kind === "operator-cli") return ", operator-cli (Operator only)";
-  return `, ${clean(kind)}`;
-}
-function sessionLines(session) {
-  let lines = "";
-  const user2 = session.user;
-  if (user2 !== null) {
-    const name = clean(user2["name"]);
-    const email = clean(user2["email"]);
-    lines += `User:        ${name === "" ? email : email === "" ? name : `${name} <${email}>`}
-`;
+  async getPolicy() {
+    return decode(policy, (await this.request("GET", "/policy")).data);
   }
-  const org = session.org;
-  if (org !== null) {
-    const name = clean(org["name"]);
-    const slug = clean(org["slug"]);
-    lines += `Org:         ${slug === "" || slug === name ? name : `${name} (${slug})`}
-`;
+  async putRepository(repoKey) {
+    return decode(
+      z.object({ repository_id: UUID, repo_key: z.string() }),
+      (await this.request("PUT", "/repositories", { repo_key: repoKey })).data
+    );
   }
-  if (session.expires_at !== null) lines += `Expires:     ${clean(session.expires_at)}
-`;
-  if (session.kind === "operator-cli") {
-    lines += "Reaches:     Operator commands only; issue, plan and gate commands are refused\n";
+  async getBase(repositoryId, commit, skipped) {
+    const r = await this.request(
+      "GET",
+      `/repositories/${encodeURIComponent(repositoryId)}/bases/${encodeURIComponent(commit)}${skipped ? "?skipped=true" : ""}`
+    );
+    const data = decode(base, r.data);
+    const wait = Math.max(data.retry_after_ms ?? 0, r.retryAfter ?? 0);
+    return wait ? { ...data, retry_after_ms: wait } : data;
+  }
+  async putView(repositoryId, key) {
+    return decode(
+      view,
+      (await this.request(
+        "PUT",
+        `/repositories/${encodeURIComponent(repositoryId)}/views/${encodeURIComponent(key)}`,
+        {}
+      )).data
+    );
   }
-  return lines;
-}
-function expertSeat(data) {
-  if (!isRecord2(data) || !isRecord2(data["expert"])) return null;
-  const plan2 = isRecord2(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
-  const steps = Array.isArray(data["assignments"]) ? data["assignments"].filter(isRecord2).length : 0;
-  return { id: data["expert"]["id"], role: data["expert"]["role"] ?? null, plan: plan2, assigned_steps: steps };
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function bareClient(baseUrl, token, options) {
-  const config = {
-    baseUrl: baseUrl.replace(/\/+$/, ""),
-    token,
-    actor: null,
-    team: null,
-    cacheDir: ""
-  };
-  if (options.fetchImpl !== void 0) config.fetchImpl = options.fetchImpl;
-  return new Client(config);
-}
-function defaultNotify(line) {
-  process.stderr.write(named(line + "\n"));
-}
-function defaultPrompt() {
-  const readline = createInterface({
-    input: process.stdin,
-    output: process.stderr
-  });
-  return new Promise((resolve) => {
-    readline.question("Token: ", (answer) => {
-      readline.close();
-      resolve(answer);
-    });
-  });
-}
-function defaultOpenBrowser(url) {
-  const opener = browserOpener();
-  if (opener !== null) {
-    execFile(opener, [url], () => void 0);
+  async getView(id) {
+    return decode(
+      view,
+      (await this.request("GET", `/views/${encodeURIComponent(id)}`)).data
+    );
   }
-}
+  async openSync(id, body) {
+    return decode(
+      opened,
+      (await this.request("POST", `/views/${encodeURIComponent(id)}/syncs`, {
+        ...body
+      })).data
+    );
+  }
+  async putBlob(hash2, bytes) {
+    HASH.parse(hash2);
+    await this.request("PUT", `/blobs/${hash2}`, bytes);
+  }
+  async getSync(viewId, syncId) {
+    return decode(syncStatus, (await this.request(
+      "GET",
+      `/views/${encodeURIComponent(viewId)}/syncs/${encodeURIComponent(syncId)}`
+    )).data);
+  }
+  async activate(viewId, syncId) {
+    return decode(
+      activated,
+      (await this.request(
+        "POST",
+        `/views/${encodeURIComponent(viewId)}/syncs/${encodeURIComponent(syncId)}/activate`,
+        {}
+      )).data
+    );
+  }
+};
 
-// src/core/stdio.ts
-var BROKEN_PIPE_CODES = /* @__PURE__ */ new Set(["EPIPE", "ERR_STREAM_DESTROYED"]);
-function guardBrokenPipes(streams = [process.stdout, process.stderr]) {
-  for (const stream of streams) {
-    stream.on("error", (error) => {
-      if (!BROKEN_PIPE_CODES.has(error.code ?? "")) throw error;
-    });
+// src/core/code/sync.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { setTimeout as delay2 } from "timers/promises";
+
+// src/core/code/git.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { realpath } from "fs/promises";
+var run2 = promisify(execFile);
+var MAX_GIT_BYTES = 16 * 1024 * 1024;
+async function gitBytes(cwd, args, maxBuffer = MAX_GIT_BYTES) {
+  try {
+    return (await run2(
+      "git",
+      [
+        "--no-optional-locks",
+        "--no-pager",
+        "-c",
+        "core.fsmonitor=false",
+        ...args
+      ],
+      { cwd, maxBuffer, timeout: 3e4, encoding: "buffer" }
+    )).stdout;
+  } catch (error) {
+    const code2 = error.code;
+    if (code2 === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" || error instanceof Error && /maxBuffer/i.test(error.message))
+      throw new LocalError(
+        "Git returned more than 16 MiB of metadata; narrow the worktree before code sync."
+      );
+    throw new LocalError(
+      "Cannot read this Git working tree. Run code commands inside a committed repository with an origin remote."
+    );
   }
 }
-
-// src/core/upgrade.ts
-import { spawn as spawn2, spawnSync } from "child_process";
-import {
-  accessSync as accessSync2,
-  constants as constants2,
-  existsSync,
-  linkSync,
-  mkdirSync,
-  readFileSync,
-  realpathSync,
-  renameSync,
-  rmSync,
-  statSync,
-  writeFileSync
-} from "fs";
-import { basename, dirname, join as join2, parse, sep } from "path";
-import { fileURLToPath } from "url";
-var PACKAGE_NAME = "@allocator-one/harness-cli";
-var PACKAGE_NAMES = [PACKAGE_NAME, OPERATOR_PACKAGE];
-var UPGRADE_INSTALL_SPEC = `${PACKAGE_NAME}@latest`;
-function upgradeInstallSpec(install) {
-  return `${install.packageName ?? PACKAGE_NAME}@latest`;
-}
-var UPDATE_CHECK_COMMAND = "__update-check";
-var REEXEC_SENTINEL = "HARNESS_UPGRADED";
-function latestUrl(packageName = PACKAGE_NAME) {
-  return `https://registry.npmjs.org/${packageName}/latest`;
-}
-var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var REGISTRY_TIMEOUT_MS = 5e3;
-var NPM_ROOT_TIMEOUT_MS = 15e3;
-var INSTALL_TIMEOUT_MS = 12e4;
-var LOCK_STALE_MS = NPM_ROOT_TIMEOUT_MS + INSTALL_TIMEOUT_MS + 6e4;
-function detectInstall(from = fileURLToPath(import.meta.url)) {
-  const unknown = {
-    kind: "unknown",
-    packageRoot: null,
-    nodeModules: null
+function decodeUtf8(value, message) {
+  const decoded = value.toString("utf8");
+  if (!Buffer.from(decoded, "utf8").equals(value)) throw new LocalError(message);
+  return decoded;
+}
+function decodeGitPaths(outputs) {
+  const paths = [];
+  for (const output of outputs) {
+    if (output.length > 0 && output.at(-1) !== 0)
+      throw new LocalError("Code sync received an incomplete Git path record.");
+    let start = 0;
+    for (let end = output.indexOf(0, start); end !== -1; end = output.indexOf(0, start)) {
+      if (end === start)
+        throw new LocalError("Code sync received an empty Git path record.");
+      const path = decodeUtf8(
+        output.subarray(start, end),
+        "Code sync cannot safely index a Git path with invalid UTF-8."
+      );
+      if (/[\x00-\x1f\x7f-\x9f]/.test(path))
+        throw new LocalError(
+          "Code sync cannot safely index a Git path with control characters."
+        );
+      paths.push(path);
+      start = end + 1;
+    }
+  }
+  return paths;
+}
+function decodeGitLine(output, message) {
+  if (output.length === 0 || output.at(-1) !== 10)
+    throw new LocalError(message);
+  return decodeUtf8(output.subarray(0, -1), message);
+}
+function assertDistinctPathIdentities(paths) {
+  const known = /* @__PURE__ */ new Map();
+  for (const path of paths) {
+    let original = "";
+    let folded = "";
+    for (const part of path.split("/")) {
+      original += `/${part}`;
+      folded += `/${part.normalize("NFC").toLocaleLowerCase("en-US").toLocaleUpperCase("en-US").normalize("NFC")}`;
+      const previous = known.get(folded);
+      if (previous !== void 0 && previous !== original)
+        throw new LocalError(
+          "Code sync cannot safely distinguish colliding Git path identities."
+        );
+      known.set(folded, original);
+    }
+  }
+}
+async function identity(cwd) {
+  const rootRecord = decodeGitLine(
+    await gitBytes(cwd, ["rev-parse", "--show-toplevel"]),
+    "Cannot resolve the Git working tree root safely."
+  );
+  if (/[\x00-\x1f\x7f-\x9f]/.test(rootRecord))
+    throw new LocalError("Cannot resolve the Git working tree root safely.");
+  const root = await realpath(rootRecord);
+  const commit = decodeGitLine(
+    await gitBytes(root, ["rev-parse", "--verify", "HEAD^{commit}"]),
+    "Cannot resolve the repository HEAD commit."
+  );
+  const remote = decodeGitLine(
+    await gitBytes(root, ["remote", "get-url", "origin"]),
+    "repository_not_connected: code indexing requires an origin on github.com shared through your organization\u2019s Harness GitHub connection."
+  );
+  if (/[\x00-\x1f\x7f-\x9f]/.test(remote))
+    throw new LocalError(
+      "repository_not_connected: code indexing requires an origin on github.com shared through your organization\u2019s Harness GitHub connection."
+    );
+  const scp = /^(?:git@)?github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/i.exec(remote);
+  let parts;
+  if (scp) parts = [scp[1], scp[2]];
+  else {
+    try {
+      const url = new URL(remote);
+      if (["https:", "ssh:", "git:"].includes(url.protocol) && url.hostname.toLowerCase() === "github.com" && !url.password && !url.search && !url.hash && (!url.port || url.protocol === "ssh:")) {
+        parts = url.pathname.replace(/^\//, "").replace(/\/$/, "").replace(/\.git$/, "").split("/");
+      }
+    } catch {
+    }
+  }
+  if (!parts || parts.length !== 2 || parts.some((p) => !p || !/^[\w.-]+$/.test(p) || p === "." || p === ".."))
+    throw new LocalError(
+      "repository_not_connected: code indexing requires an origin on github.com shared through your organization\u2019s Harness GitHub connection."
+    );
+  if (!/^[0-9a-f]{40,64}$/.test(commit))
+    throw new LocalError("Cannot resolve the repository HEAD commit.");
+  return {
+    root,
+    commit,
+    repoKey: `github.com/${parts.join("/").toLowerCase()}`
   };
-  if (from.split(sep).includes("_npx")) return { ...unknown, kind: "npx" };
-  const found = findPackageRoot(from);
-  if (found === null) return unknown;
-  const { packageRoot, packageName } = found;
-  if (existsSync(join2(packageRoot, ".git"))) {
-    return { kind: "checkout", packageRoot, packageName, nodeModules: null };
-  }
-  const nodeModules = enclosingNodeModules(packageRoot);
-  if (nodeModules === null) return { ...unknown, packageRoot, packageName };
-  const kind = existsSync(join2(nodeModules, ".bin")) ? "local" : "global";
-  return { kind, packageRoot, packageName, nodeModules };
-}
-function findPackageRoot(from) {
-  let dir = dirname(from);
-  const { root } = parse(dir);
-  for (; ; ) {
-    const name = packageNameAt(join2(dir, "package.json"));
-    if (name !== null && PACKAGE_NAMES.includes(name))
-      return { packageRoot: dir, packageName: name };
-    if (dir === root) return null;
-    dir = dirname(dir);
-  }
-}
-function packageNameAt(path) {
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const name = parsed["name"];
-    return typeof name === "string" ? name : null;
-  } catch {
+}
+async function changedPaths(root, commit) {
+  const changed = await gitBytes(root, [
+    "diff",
+    "--name-only",
+    "-z",
+    "--no-renames",
+    "--no-ext-diff",
+    "--no-textconv",
+    commit,
+    "--"
+  ]);
+  const untracked = await gitBytes(root, [
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "-z"
+  ]);
+  return [
+    ...new Set(decodeGitPaths([changed, untracked]))
+  ].sort(
+    (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b))
+  );
+}
+
+// src/core/code/scan.ts
+import { constants as constants2 } from "fs";
+import { open } from "fs/promises";
+import { join } from "path";
+import { createHash } from "crypto";
+import { release } from "os";
+
+// src/core/code/policy.ts
+import { isUtf8 } from "buffer";
+import { extname } from "path";
+
+// src/core/code/glob.ts
+var MAX_PATTERN_BYTES = 256;
+var MAX_PATTERN_STARS = 8;
+var MAX_PATTERNS = 1e3;
+function compileIgnorePatterns(lines, warnings) {
+  const patterns = [];
+  for (const [line, raw] of lines.entries()) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    if (trimmed.startsWith("!")) {
+      warnings.push(
+        `Ignoring .harnesscodeignore negation on line ${line + 1}; code-index patterns do not support !.`
+      );
+      continue;
+    }
+    if (trimmed.includes("\\")) {
+      warnings.push(
+        `The .harnesscodeignore backslash on line ${line + 1} is literal and never matches a normalized source path.`
+      );
+    }
+    if (Buffer.byteLength(trimmed) > MAX_PATTERN_BYTES || (trimmed.match(/\*/g)?.length ?? 0) > MAX_PATTERN_STARS) {
+      warnings.push(
+        "Ignoring .harnesscodeignore pattern outside the code-index size limits."
+      );
+      continue;
+    }
+    if (patterns.length === MAX_PATTERNS) {
+      warnings.push(
+        "Ignoring .harnesscodeignore patterns after the first 1,000 valid entries."
+      );
+      break;
+    }
+    const pattern = compilePattern(trimmed);
+    if (pattern) patterns.push(pattern);
+  }
+  return patterns;
+}
+function patternLimitError() {
+  return new Error("Code upload policy contains an invalid path pattern.");
+}
+function escapeRegex(pattern) {
+  return pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function globBody(pattern) {
+  return escapeRegex(pattern).replaceAll("\\*\\*/", "(?:.*/)?").replaceAll("/\\*\\*", "/.*").replaceAll("\\*", "[^/]*").replaceAll("\\?", "[^/]");
+}
+function compilePattern(raw, {
+  caseInsensitive = false,
+  mode = "ignore",
+  warnings,
+  maxPatternBytes = MAX_PATTERN_BYTES,
+  maxStars = MAX_PATTERN_STARS,
+  rejectUnsupported = false
+} = {}) {
+  let pattern = mode === "served" ? raw : raw.trim();
+  if (pattern === "") return null;
+  if (pattern.startsWith("#")) {
+    if (rejectUnsupported) throw patternLimitError();
     return null;
   }
-}
-function versionAt(packageRoot) {
-  try {
-    const parsed = JSON.parse(
-      readFileSync(join2(packageRoot, "package.json"), "utf8")
+  if (Buffer.byteLength(pattern) > maxPatternBytes || (pattern.match(/\*/g)?.length ?? 0) > maxStars)
+    throw patternLimitError();
+  if (pattern.startsWith("!")) {
+    if (rejectUnsupported) throw patternLimitError();
+    warnings?.push(
+      "Ignoring .harnesscodeignore negation; code-index patterns do not support !."
     );
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const version2 = parsed["version"];
-    return typeof version2 === "string" ? version2 : null;
-  } catch {
     return null;
   }
-}
-function enclosingNodeModules(packageRoot) {
-  let dir = dirname(packageRoot);
-  const { root } = parse(dir);
-  for (; ; ) {
-    if (basename(dir) === "node_modules") return dir;
-    if (dir === root) return null;
-    dir = dirname(dir);
+  if (pattern.includes("\\")) {
+    if (rejectUnsupported) throw patternLimitError();
+    warnings?.push(
+      "A .harnesscodeignore backslash is literal, not an escape."
+    );
   }
-}
-var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
-function parseVersion(value) {
-  const match = SEMVER.exec(value.trim());
-  if (match === null) return null;
+  if (rejectUnsupported && /[\[\]{}]/.test(pattern)) throw patternLimitError();
+  const anchored = pattern.includes("/");
+  if (mode === "ignore") pattern = pattern.replace(/^\/+|\/+$/g, "");
+  const prefix = anchored ? "^" : "^(?:.*/)?";
+  const suffix = mode === "ignore" ? "(?:/.*)?$" : "$";
   return {
-    parts: [Number(match[1]), Number(match[2]), Number(match[3])],
-    pre: match[4] ?? null
+    source: mode === "served" ? raw : raw.trim(),
+    negated: false,
+    regex: new RegExp(
+      prefix + globBody(pattern) + suffix,
+      caseInsensitive ? "i" : ""
+    )
   };
 }
-function isNewer(candidate, current) {
-  const a = parseVersion(candidate);
-  const b = parseVersion(current);
-  if (a === null || b === null) return false;
-  for (let index = 0; index < 3; index++) {
-    if (a.parts[index] !== b.parts[index])
-      return a.parts[index] > b.parts[index];
-  }
-  if (a.pre === b.pre) return false;
-  if (a.pre === null) return true;
-  if (b.pre === null) return false;
-  return comparePrerelease(a.pre, b.pre) > 0;
-}
-function comparePrerelease(left, right) {
-  const a = left.split(".");
-  const b = right.split(".");
-  for (let index = 0; index < Math.max(a.length, b.length); index++) {
-    const x = a[index];
-    const y = b[index];
-    if (x === void 0) return -1;
-    if (y === void 0) return 1;
-    const xNumeric = /^\d+$/.test(x);
-    const yNumeric = /^\d+$/.test(y);
-    if (xNumeric && yNumeric) {
-      if (Number(x) !== Number(y)) return Number(x) < Number(y) ? -1 : 1;
-    } else if (xNumeric !== yNumeric) {
-      return xNumeric ? -1 : 1;
-    } else if (x !== y) {
-      return x < y ? -1 : 1;
-    }
-  }
-  return 0;
+function compilePatterns(lines, options = {}) {
+  const maxPatterns = options.maxPatterns ?? MAX_PATTERNS;
+  if (lines.length > maxPatterns) throw patternLimitError();
+  return lines.map((line) => compilePattern(line, options)).filter((pattern) => pattern !== null);
 }
-function stampPath(env = process.env, packageName = PACKAGE_NAME) {
-  const file = packageName === PACKAGE_NAME ? "update-check.json" : `update-check-${packageName.replace(/^@[^/]+\//, "")}.json`;
-  return join2(resolveCacheHome(env), "harness", file);
+function matchingPattern(path, patterns) {
+  let decided = null;
+  for (const pattern of patterns) if (pattern.regex.test(path)) decided = pattern;
+  return decided;
 }
-function readStamp(env = process.env, packageName = PACKAGE_NAME) {
-  try {
-    const parsed = JSON.parse(
-      readFileSync(stampPath(env, packageName), "utf8")
+
+// src/core/code/policy.ts
+var MAX_FILE_BYTES = 1048576;
+var EXTENSIONS = [
+  ".ex",
+  ".exs",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".swift"
+];
+var DENY = [
+  ".env",
+  ".env.*",
+  "secrets/**",
+  "**/secrets/**",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.pfx",
+  "*.jks",
+  "*.keystore",
+  "id_rsa*",
+  "id_ecdsa*",
+  "id_ed25519*",
+  "*.kdbx",
+  ".npmrc",
+  ".netrc",
+  "credentials.json",
+  "**/.aws/**",
+  ".git/**",
+  "node_modules/**",
+  "_build/**",
+  "deps/**",
+  "dist/**",
+  "*.lock",
+  "package-lock.json",
+  "*.min.js",
+  "*.map",
+  "priv/static/**",
+  "src/generated/**",
+  "DerivedData/**",
+  "**/DerivedData/**",
+  ".build/**",
+  "**/.build/**",
+  "Pods/**",
+  "Carthage/Build/**",
+  "xcuserdata/**",
+  "**/xcuserdata/**",
+  "*.xcuserstate",
+  "*.xcresult/**",
+  "*.xcarchive/**",
+  "*.dSYM/**",
+  "*.ipa",
+  "*.secret.exs"
+];
+var SECRET_PATTERN_SOURCES = [
+  "-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----",
+  "\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b",
+  "\\baone_[A-Za-z0-9_-]{20,}",
+  "\\bgh[opsur]_[A-Za-z0-9]{36}\\b",
+  "\\b[rs]k_live_[A-Za-z0-9]{20,}",
+  "\\bAIza[0-9A-Za-z_-]{35}\\b",
+  "\\bxapp-\\d-[A-Za-z0-9-]{20,}",
+  "hooks\\.slack\\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+",
+  "\\bgithub_pat_[A-Za-z0-9_]{22,}",
+  "\\bxox[baprs]-\\d{8,}-[A-Za-z0-9-]{10,}",
+  "\\bsk-(?:proj-|ant-[a-z0-9]+-)?[A-Za-z0-9_-]{32,}"
+];
+var SECRETS = SECRET_PATTERN_SOURCES.map((source) => new RegExp(source));
+function contentMatchers(patterns) {
+  const literalMarkers = [];
+  for (const pattern of patterns) {
+    if (SECRET_PATTERN_SOURCES.includes(pattern)) continue;
+    if (!pattern || /[\\^$.*+?()[\]{}|]/.test(pattern))
+      throw new Error("unknown regular expression");
+    literalMarkers.push(pattern);
+  }
+  return literalMarkers;
+}
+function servedCase(served) {
+  const value = served.deny_glob_case;
+  if (value !== void 0 && value !== "ascii_insensitive")
+    throw new Error("unknown deny glob case mode");
+  return value;
+}
+function buildPolicy(served, ignore, includeFloor) {
+  const warnings = [];
+  const unsupported = [...new Set(
+    served.include_extensions.filter((extension) => !EXTENSIONS.includes(extension))
+  )].sort();
+  if (unsupported.length)
+    warnings.push(
+      `This harness-cli does not send ${unsupported.join(", ")} files; upgrade the client.`
     );
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const record = parsed;
-    const checkedAt = record["checkedAt"];
-    if (typeof checkedAt !== "number" || !Number.isFinite(checkedAt))
-      return null;
-    const latest = record["latest"];
-    return { checkedAt, latest: typeof latest === "string" ? latest : null };
+  const insensitiveServed = servedCase(served) === "ascii_insensitive";
+  const literalMarkers = contentMatchers(served.content_patterns);
+  return {
+    limit: Math.min(served.max_file_bytes, MAX_FILE_BYTES),
+    deny: [
+      ...includeFloor ? compilePatterns(DENY, {
+        caseInsensitive: true,
+        maxPatterns: Infinity,
+        maxPatternBytes: Infinity,
+        maxStars: Infinity
+      }) : [],
+      ...compilePatterns(served.deny_globs, {
+        caseInsensitive: includeFloor || insensitiveServed,
+        mode: "served",
+        maxPatternBytes: 1024,
+        maxStars: Infinity,
+        rejectUnsupported: true
+      })
+    ],
+    ignore: compileIgnorePatterns(ignore.split(/\r?\n/), warnings),
+    patterns: SECRETS,
+    literalMarkers,
+    extensions: new Set(
+      EXTENSIONS.filter((extension) => served.include_extensions.includes(extension))
+    ),
+    warnings
+  };
+}
+function policyFor(served, ignore) {
+  try {
+    return buildPolicy(served, ignore, true);
   } catch {
-    return null;
+    throw new CommandError(
+      "The server returned an invalid code upload policy; upgrade the client before code sync."
+    );
   }
 }
-function writeStamp(stamp, env = process.env, packageName = PACKAGE_NAME) {
-  const path = stampPath(env, packageName);
-  const temporary = `${path}.${process.pid}.tmp`;
-  const latest = stamp.latest ?? readStamp(env, packageName)?.latest ?? null;
+function basePolicyFor(served, ignore) {
   try {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(temporary, JSON.stringify({ ...stamp, latest }) + "\n");
-    renameSync(temporary, path);
+    return buildPolicy(served, ignore, false);
   } catch {
-    try {
-      rmSync(temporary, { force: true });
-    } catch {
-    }
+    throw new CommandError(
+      "The server returned an invalid code upload policy; upgrade the client before code sync."
+    );
   }
 }
-function updateCheck(options = {}) {
-  const env = options.env ?? process.env;
-  const now = options.now ?? Date.now();
-  if (!checksEnabled(env)) return null;
-  const install = options.install ?? detectInstall();
-  if (install.kind !== "global" && install.kind !== "local") return null;
-  const packageName = install.packageName ?? PACKAGE_NAME;
-  const stamp = readStamp(env, packageName);
-  if (stamp === null || now - stamp.checkedAt >= CHECK_INTERVAL_MS) {
-    writeStamp({ checkedAt: now, latest: stamp?.latest ?? null }, env, packageName);
-    (options.refresh ?? spawnRefresh)();
-  }
-  if (stamp !== null && stamp.latest !== null && isNewer(stamp.latest, CLI_VERSION)) {
-    return `harness: ${stamp.latest} is available (you have ${CLI_VERSION}) \u2014 ${upgradeHint(install)}
-`;
-  }
-  return null;
+function pathReason(path, p) {
+  if (!path || Buffer.byteLength(path) > 1024 || /[\\\x00-\x1f\x7f-\x9f]/.test(path) || Buffer.from(path, "utf8").toString("utf8") !== path || path.split("/").some((segment) => ["", ".", ".."].includes(segment)))
+    return "invalid_path";
+  if (p.deny.some((pattern) => pattern.regex.test(path))) return "excluded_path";
+  if (matchingPattern(path, p.ignore)) return "ignored";
+  return p.extensions.has(extname(path)) ? null : "unsupported_language";
 }
-function upgradeHint(install) {
-  return install.kind === "local" ? `npm i ${upgradeInstallSpec(install)}` : `npm i -g ${upgradeInstallSpec(install)}`;
+function extensionWarning(path, p) {
+  const extension = extname(path);
+  return !p.extensions.has(extension) && p.extensions.has(extension.toLowerCase()) ? `The server indexes ${extension.toLowerCase()} exactly; ${path} was skipped.` : null;
 }
-function spawnRefresh() {
-  const self = process.argv[1];
-  if (self === void 0 || self === "") return;
-  try {
-    const child = spawn2(process.execPath, [self, UPDATE_CHECK_COMMAND], {
-      detached: true,
-      stdio: "ignore"
-    });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
+function contentReason(bytes, p) {
+  if (bytes.length > p.limit) return "too_large";
+  if (bytes.includes(0) || !isUtf8(bytes)) return "binary";
+  const text = bytes.toString("utf8");
+  return p.patterns.some((pattern) => pattern.test(text)) || p.literalMarkers.some((marker) => text.includes(marker)) ? "secret_content" : null;
 }
-async function performUpdateCheck(env = process.env, now = Date.now(), packageName = detectInstall().packageName ?? PACKAGE_NAME) {
-  if (!checksEnabled(env)) return;
-  writeStamp(
-    { checkedAt: now, latest: await fetchLatestVersion(env, packageName) },
-    env,
-    packageName
+
+// src/core/code/scan.ts
+var MAX_OVERLAY_BYTES = 64 * 1024 * 1024;
+var MAX_OVERLAY_CHANGES = 2e4;
+var O_NOFOLLOW_ANY = 536870912;
+function sha256(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+function supportsDarwinNoFollowAny(osRelease = release()) {
+  const major = Number(osRelease.split(".")[0]);
+  return Number.isInteger(major) && major >= 20;
+}
+async function committedIgnore(root, commit) {
+  const entry = decodeUtf8(
+    await gitBytes(root, [
+      "ls-tree",
+      "-z",
+      commit,
+      "--",
+      ".harnesscodeignore"
+    ]),
+    "Cannot read the committed .harnesscodeignore safely."
+  );
+  if (!entry) return "";
+  const match = /^(\d+) blob ([0-9a-f]+)\t\.harnesscodeignore\0$/.exec(entry);
+  if (!match || !["100644", "100755"].includes(match[1]))
+    throw new LocalError(
+      "The committed .harnesscodeignore must be a regular file before code sync."
+    );
+  return decodeUtf8(
+    await gitBytes(root, ["cat-file", "blob", match[2]], 65537),
+    "The committed .harnesscodeignore must be valid UTF-8 before code sync."
   );
 }
-async function fetchLatestVersion(env, packageName) {
-  const configured = env["HARNESS_REGISTRY_URL"];
-  const url = configured !== void 0 && configured.trim() !== "" ? configured.trim() : latestUrl(packageName);
+var directoryFlags = constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK;
+async function openLinuxRoot(root) {
+  let handle;
   try {
-    const response = await fetch(url, {
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS)
-    });
-    if (!response.ok) return null;
-    const parsed = await response.json();
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const version2 = parsed["version"];
-    if (typeof version2 !== "string" || parseVersion(version2) === null)
-      return null;
-    return version2;
+    if (!root.startsWith("/"))
+      throw new Error("repository root is not absolute");
+    handle = await open("/", directoryFlags);
+    for (const part of root.split("/").filter(Boolean)) {
+      if (part === "." || part === "..")
+        throw new Error("repository root is invalid");
+      const next = await open(
+        `/proc/self/fd/${handle.fd}/${part}`,
+        directoryFlags
+      );
+      await handle.close();
+      handle = next;
+    }
+    return handle;
   } catch {
-    return null;
+    await handle?.close().catch(() => {
+    });
+    throw new LocalError(
+      "Code sync cannot establish a safe source root on this platform."
+    );
   }
 }
-function selfHeal(options = {}) {
-  const env = options.env ?? process.env;
-  const argv2 = options.argv ?? process.argv;
-  if (truthy(env[REEXEC_SENTINEL])) {
-    return {
-      kind: "skipped",
-      reason: "already upgraded once for this command"
-    };
-  }
-  if (!autoUpgradeEnabled(env))
-    return { kind: "skipped", reason: "automatic upgrades are off" };
-  if (argv2[2] === "mcp")
-    return {
-      kind: "skipped",
-      reason: "an MCP session must not be replaced mid-stream"
-    };
-  const install = options.install ?? detectInstall();
-  if (install.kind !== "global" || install.packageRoot === null) {
-    return { kind: "skipped", reason: describeInstall(install.kind) };
+async function openLinuxBelowRoot(root, path) {
+  let handle = await openLinuxRoot(root);
+  try {
+    const parts = path.split("/");
+    for (const [index, part] of parts.entries()) {
+      if (!part || part === "." || part === "..")
+        throw new LocalError(
+          "Cannot read an overlay file safely; invalid path."
+        );
+      const next = await open(
+        `/proc/self/fd/${handle.fd}/${part}`,
+        constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK | (index === parts.length - 1 ? 0 : constants2.O_DIRECTORY)
+      );
+      await handle.close();
+      handle = next;
+    }
+    return handle;
+  } catch (error) {
+    await handle.close().catch(() => {
+    });
+    throw error;
   }
-  const packageRoot = install.packageRoot;
-  const installed = versionAt(packageRoot);
-  if (installed !== null && isNewer(installed, CLI_VERSION)) {
-    return { kind: "upgraded", code: reexec(options, env, argv2) };
+}
+async function openSafe(root, path) {
+  if (process.platform === "darwin") {
+    if (!supportsDarwinNoFollowAny())
+      throw new LocalError(
+        "Code sync requires macOS 11 or later for safe source reads."
+      );
+    return open(
+      join(root, path),
+      constants2.O_RDONLY | O_NOFOLLOW_ANY | constants2.O_NONBLOCK
+    );
   }
-  const lock = takeLock(env);
-  if (lock === null)
-    return {
-      kind: "skipped",
-      reason: "another harness process is already upgrading"
-    };
+  if (process.platform === "linux") return openLinuxBelowRoot(root, path);
+  throw new LocalError(
+    "Code sync cannot safely read source files on this platform."
+  );
+}
+async function readSafe(root, path, limit) {
   try {
-    const stillHeld = () => readHolder(lock.path)?.pid === lock.pid;
-    const result = (options.runInstall ?? npmInstallGlobal)(install, stillHeld);
-    if (!result.ok) return { kind: "failed", reason: result.detail };
-    const after = versionAt(packageRoot);
-    if (after !== null && after === installed) {
+    const handle = await openSafe(root, path);
+    try {
+      const before = await handle.stat();
+      if (!before.isFile()) return { reason: "not_regular_file" };
+      if (before.size > limit) return { reason: "too_large" };
+      const bytes = Buffer.allocUnsafe(Math.min(before.size, limit) + 1);
+      let total = 0;
+      while (total < bytes.length) {
+        const { bytesRead } = await handle.read(
+          bytes,
+          total,
+          bytes.length - total,
+          null
+        );
+        if (bytesRead === 0) break;
+        total += bytesRead;
+      }
+      const after = await handle.stat();
+      if (total > limit) return { reason: "too_large" };
+      if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || total !== after.size)
+        throw new LocalError(
+          "A source file changed during scanning; retry code sync."
+        );
       return {
-        kind: "failed",
-        reason: `still ${after} after upgrading \u2014 no newer release is published`
+        bytes: bytes.subarray(0, total),
+        mode: before.mode & 64 ? "100755" : "100644"
       };
+    } finally {
+      await handle.close();
     }
-    if (after !== null && installed !== null && !isNewer(after, installed)) {
-      return {
-        kind: "failed",
-        reason: `npm left ${after} installed, which is not newer than ${installed}`
-      };
+  } catch (error) {
+    const code2 = error.code;
+    if (code2 === "ENOENT") return { reason: "deleted" };
+    if (code2 === "ELOOP" || code2 === "ENOTDIR") return { reason: "symlink" };
+    if (error instanceof LocalError) throw error;
+    throw new LocalError(
+      "Cannot read an overlay file safely; check permissions and retry code sync."
+    );
+  }
+}
+async function scanOverlay(id, served) {
+  policyFor(served, "");
+  const ignore = await readSafe(id.root, ".harnesscodeignore", 65536);
+  if ("reason" in ignore && ignore.reason !== "deleted")
+    throw new LocalError(
+      "Cannot read .harnesscodeignore safely; fix or remove it before code sync."
+    );
+  const localIgnore = "bytes" in ignore ? decodeUtf8(
+    ignore.bytes,
+    "The local .harnesscodeignore must be valid UTF-8 before code sync."
+  ) : "";
+  const baseIgnore = await committedIgnore(id.root, id.commit);
+  if (Buffer.byteLength(baseIgnore) > 65536)
+    throw new LocalError(
+      "The committed .harnesscodeignore exceeds 64 KiB; reduce it before code sync."
+    );
+  const policy2 = policyFor(served, localIgnore);
+  const basePolicy = basePolicyFor(served, baseIgnore);
+  const paths = await changedPaths(id.root, id.commit);
+  const basePaths = new Set(
+    decodeGitPaths([
+      await gitBytes(id.root, ["ls-tree", "-r", "--name-only", "-z", id.commit])
+    ])
+  );
+  assertDistinctPathIdentities([...basePaths, ...paths]);
+  const changes = [];
+  const deleted = /* @__PURE__ */ new Set();
+  const blobs = /* @__PURE__ */ new Map();
+  const excluded = [];
+  const baseWouldHold = (path) => basePaths.has(path) && pathReason(path, basePolicy) === null;
+  const deleteBasePath = (path) => {
+    if (baseWouldHold(path) && !deleted.has(path)) {
+      if (changes.length >= MAX_OVERLAY_CHANGES)
+        throw new LocalError(
+          `overlay_too_large: the overlay exceeds ${MAX_OVERLAY_CHANGES} entries. Commit the ignore file so the base honors it.`
+        );
+      deleted.add(path);
+      changes.push({ op: "delete", path });
     }
-  } finally {
-    releaseLock(lock);
+  };
+  const candidates = new Set(paths);
+  const warnings = /* @__PURE__ */ new Set([...policy2.warnings, ...basePolicy.warnings]);
+  for (const path of basePaths) {
+    const baseReason = pathReason(path, basePolicy);
+    const localReason = pathReason(path, policy2);
+    if (baseReason === null && (localReason === "excluded_path" || localReason === "ignored"))
+      deleteBasePath(path);
+    if (baseReason === "ignored" && localReason === null) candidates.add(path);
+  }
+  let total = 0;
+  for (const path of [...candidates].sort(
+    (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b))
+  )) {
+    const reason = pathReason(path, policy2);
+    if (reason) {
+      excluded.push({ path, reason });
+      if (reason === "ignored" || reason === "excluded_path") deleteBasePath(path);
+      const warning = extensionWarning(path, policy2);
+      if (warning) warnings.add(warning);
+      continue;
+    }
+    const read = await readSafe(id.root, path, policy2.limit);
+    if ("reason" in read) {
+      if (read.reason !== "deleted")
+        excluded.push({ path, reason: read.reason });
+      deleteBasePath(path);
+      continue;
+    }
+    const content = contentReason(read.bytes, policy2);
+    if (content) {
+      excluded.push({ path, reason: content });
+      deleteBasePath(path);
+      continue;
+    }
+    const hash2 = sha256(read.bytes);
+    if (!blobs.has(hash2)) {
+      total += read.bytes.length;
+      if (total > MAX_OVERLAY_BYTES)
+        throw new LocalError(
+          "The overlay exceeds the 64 MiB client upload limit; split the change before syncing."
+        );
+      blobs.set(hash2, read.bytes);
+    }
+    if (changes.length >= MAX_OVERLAY_CHANGES)
+      throw new LocalError(
+        `overlay_too_large: the overlay exceeds ${MAX_OVERLAY_CHANGES} entries. Commit the ignore file so the base honors it.`
+      );
+    changes.push({
+      op: "put",
+      path,
+      sha256: hash2,
+      size: read.bytes.length,
+      mode: read.mode
+    });
   }
-  return { kind: "upgraded", code: reexec(options, env, argv2) };
+  changes.sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)));
+  const digest = sha256(
+    changes.map(
+      (c) => c.op === "delete" ? `${c.path}\0-\0-
+` : `${c.path}\0${c.sha256}\0${c.mode}
+`
+    ).join("")
+  );
+  return {
+    changes,
+    blobs,
+    excluded,
+    warnings: [...warnings],
+    digest
+  };
 }
-function reexec(options, env, argv2) {
-  return (options.reexec ?? reexecSelf)(
-    { ...env, [REEXEC_SENTINEL]: "1" },
-    argv2
+
+// src/core/code/state.ts
+import {
+  readFile,
+  mkdir,
+  writeFile,
+  rename,
+  unlink,
+  rmdir
+} from "fs/promises";
+import { join as join2, resolve, isAbsolute } from "path";
+import { randomUUID } from "crypto";
+function statePath(server, org, root, repoKey, directory) {
+  const url = new URL(server);
+  const canonical = url.origin + url.pathname.replace(/\/+$/, "");
+  const base2 = directory ?? process.env["HARNESS_CODE_STATE_DIR"] ?? join2(resolveCacheHome(), "harness", "code");
+  if (!isAbsolute(base2))
+    throw new LocalError("HARNESS_CODE_STATE_DIR must be an absolute path.");
+  return join2(
+    resolve(base2),
+    sha256(JSON.stringify([canonical, org.toLowerCase()])),
+    sha256(JSON.stringify([root, repoKey])) + ".json"
   );
 }
-function describeInstall(kind) {
-  switch (kind) {
-    case "checkout":
-      return "this is a git checkout, not an npm install";
-    case "local":
-      return "this copy is a project dependency, not a global install";
-    case "npx":
-      return "npx runs a throwaway copy";
-    default:
-      return "cannot tell how this CLI was installed";
-  }
-}
-function npmInstallGlobal(install, stillHeld) {
-  const globalRoot = npmGlobalRoot();
-  if (globalRoot === null)
-    return { ok: false, detail: "npm did not say where its global root is" };
-  if (globalRoot.includes("***")) {
-    return {
-      ok: false,
-      detail: "npm redacted its own global root, so this copy's location cannot be confirmed"
-    };
+async function readState(path, server, org, root, repoKey) {
+  try {
+    const s = JSON.parse(await readFile(path, "utf8"));
+    if (typeof s !== "object" || s === null) throw new Error();
+    const state2 = s;
+    if (state2.org.toLowerCase() !== org.toLowerCase() || state2.root !== root || state2.repoKey !== repoKey || new URL(state2.server).href !== new URL(server).href || typeof state2.viewKey !== "string" || !/^[\da-f-]{36}$/.test(state2.viewKey))
+      throw new Error();
+    return { ...state2, org: state2.org.toLowerCase() };
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new LocalError(
+      "The code view state is invalid or belongs to another scope. Check HARNESS_CODE_STATE_DIR; no source was uploaded."
+    );
   }
-  if (install.nodeModules === null || !samePath(globalRoot, install.nodeModules)) {
-    return {
-      ok: false,
-      detail: `this copy lives in ${install.nodeModules ?? "an unrecognized place"}, not npm's global root (${globalRoot})`
-    };
+}
+async function initialState(path, server, org, root, repoKey) {
+  const previous = await readState(path, server, org, root, repoKey);
+  if (previous) return previous;
+  const state2 = { server, org: org.toLowerCase(), root, repoKey, viewKey: randomUUID() };
+  await mkdir(join2(path, ".."), { recursive: true, mode: 448 });
+  try {
+    await writeFile(path, JSON.stringify(state2) + "\n", {
+      flag: "wx",
+      mode: 384
+    });
+    return state2;
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      const raced = await readState(path, server, org, root, repoKey);
+      if (raced) return raced;
+    }
+    throw new LocalError("Cannot save isolated code view state.");
   }
+}
+async function saveState(path, state2) {
+  const tmp = `${path}.${randomUUID()}.tmp`;
   try {
-    accessSync2(globalRoot, constants2.W_OK);
+    await writeFile(tmp, JSON.stringify({ ...state2, org: state2.org.toLowerCase() }) + "\n", {
+      flag: "wx",
+      mode: 384
+    });
+    await rename(tmp, path);
   } catch {
-    return {
-      ok: false,
-      detail: `${globalRoot} is not writable \u2014 upgrade it yourself`
-    };
-  }
-  if (!stillHeld()) {
-    return {
-      ok: false,
-      detail: "lost the upgrade lock while preparing \u2014 another process took over"
-    };
-  }
-  process.stderr.write(
-    named(`harness: upgrading ${install.packageName ?? PACKAGE_NAME} \u2026
-`)
-  );
-  const args = [
-    "install",
-    "--global",
-    "--ignore-scripts",
-    "--no-audit",
-    "--no-fund",
-    "--no-update-notifier",
-    "--loglevel=error",
-    upgradeInstallSpec(install)
-  ];
-  const result = spawnSync(npmCommand(), args, {
-    // npm's diagnostics belong on stderr with ours; stdout stays the
-    // command's own, so its summary is dropped rather than piped into jq.
-    stdio: ["ignore", "ignore", "inherit"],
-    timeout: INSTALL_TIMEOUT_MS,
-    ...npmSpawnOptions()
-  });
-  if (result.error !== void 0)
-    return { ok: false, detail: result.error.message };
-  if (result.status !== 0) {
-    return {
-      ok: false,
-      detail: `npm install exited ${result.status ?? `on ${String(result.signal)}`}`
-    };
+    throw new LocalError(
+      "Cannot save code sync progress; retry with the same worktree and state directory."
+    );
+  } finally {
+    await unlink(tmp).catch(() => {
+    });
   }
-  return { ok: true, detail: "" };
 }
-function npmGlobalRoot() {
+async function withSyncLock(path, action) {
+  const lock = path + ".lock";
+  await mkdir(join2(path, ".."), { recursive: true, mode: 448 });
+  try {
+    await mkdir(lock, { mode: 448 });
+  } catch (error) {
+    if (error.code === "EEXIST")
+      throw new LocalError(
+        `A code sync is already running for this view. Wait for it to finish. If it was interrupted, confirm no sync is running before removing its lock directory: ${lock}`
+      );
+    throw new LocalError(
+      "Cannot lock code sync progress; check the state directory permissions."
+    );
+  }
   try {
-    const result = spawnSync(npmCommand(), ["root", "--global"], {
-      encoding: "utf8",
-      timeout: NPM_ROOT_TIMEOUT_MS,
-      ...npmSpawnOptions()
+    await writeFile(join2(lock, "owner"), `${process.pid}
+`, {
+      flag: "wx",
+      mode: 384
     });
-    if (result.status !== 0 || typeof result.stdout !== "string") return null;
-    const path = result.stdout.trim();
-    return path === "" ? null : path;
-  } catch {
-    return null;
+    return await action();
+  } finally {
+    await unlink(join2(lock, "owner")).catch(() => {
+    });
+    try {
+      await rmdir(lock);
+    } catch {
+      try {
+        process.stderr.write(named(
+          `harness: Warning: code sync lock cleanup failed at ${clean(lock)}. If the lock remains, confirm no sync is running before removing it.
+`
+        ));
+      } catch {
+      }
+    }
+  }
+}
+
+// src/core/code/sync.ts
+async function baseReady(api, repo, commit, options) {
+  const timeout = options.pollTimeoutMs ?? 6e5;
+  const sleep = options.sleep ?? delay2;
+  let waited = 0;
+  let interval = 1e3;
+  const started = Date.now();
+  for (let attempts = 0; attempts < 600; attempts++) {
+    const base2 = await api.getBase(repo, commit, options.skipped === true);
+    if (base2.state === "complete" || base2.state === "ready") return base2;
+    if (base2.state === "failed")
+      throw new CommandError(
+        "The server could not build this commit\u2019s base. Check code status --skipped, then retry after the server backoff."
+      );
+    const backoff = base2.retry_after_ms === 0 ? interval : base2.retry_after_ms ?? interval;
+    if (!Number.isFinite(backoff) || backoff < 0 || Math.max(waited, Date.now() - started) + backoff > timeout)
+      throw new CommandError(
+        "Timed out waiting for the server-built base; retry code sync to resume."
+      );
+    await sleep(backoff);
+    waited += backoff;
+    interval = Math.min(interval * 2, 1e4);
   }
+  throw new CommandError("The base is still fetching; retry code sync later.");
 }
-function npmCommand() {
-  return process.platform === "win32" ? "npm.cmd" : "npm";
+function stale(error) {
+  return error instanceof HttpError && error.status === 409 && error.body["error"] === "stale_policy";
 }
-function npmSpawnOptions() {
-  return process.platform === "win32" ? { shell: true } : {};
+function withinActivationRetention(attemptedAt) {
+  const elapsed = typeof attemptedAt === "number" ? Date.now() - attemptedAt : NaN;
+  return Number.isFinite(elapsed) && elapsed >= 0 && elapsed < 60 * 6e4;
 }
-function samePath(left, right) {
-  const resolve = (path) => {
+var ReplacedSyncError = class extends CommandError {
+  constructor() {
+    super(
+      "The server replaced this sync before activation. Retry code sync with no other sync running for this view."
+    );
+  }
+};
+function policyScope(policy2) {
+  if (!/^[\da-f]{8}-(?:[\da-f]{4}-){3}[\da-f]{12}$/i.test(policy2.org_id) || !policy2.policy_digest || !Number.isSafeInteger(policy2.max_file_bytes) || policy2.max_file_bytes < 1)
+    throw new CommandError(
+      "The server did not provide a valid organization and upload policy; no source was uploaded."
+    );
+  policyFor(policy2, "");
+}
+async function syncCode(api, options) {
+  const id = await identity(options.cwd);
+  let policyRestarts = 0;
+  let syncRestarts = 0;
+  for (let restart = 0; restart < 3; restart++) {
+    const policy2 = await api.getPolicy();
+    policyScope(policy2);
+    const path = statePath(
+      api.origin,
+      policy2.org_id,
+      id.root,
+      id.repoKey,
+      options.stateDir
+    );
     try {
-      return realpathSync(path);
-    } catch {
-      return path;
+      return await withSyncLock(path, async () => {
+        const state2 = await initialState(
+          path,
+          api.origin,
+          policy2.org_id,
+          id.root,
+          id.repoKey
+        );
+        const repo = await api.putRepository(id.repoKey);
+        if (repo.repo_key !== id.repoKey)
+          throw new CommandError(
+            "The server resolved a different repository; no source was uploaded."
+          );
+        if (state2.repositoryId && state2.repositoryId !== repo.repository_id) {
+          delete state2.viewId;
+          delete state2.pending;
+          delete state2.activated;
+        }
+        state2.repositoryId = repo.repository_id;
+        state2.baseCommit = id.commit;
+        await saveState(path, state2);
+        const base2 = await baseReady(
+          api,
+          repo.repository_id,
+          id.commit,
+          options
+        );
+        if (base2.policy_digest && base2.policy_digest !== policy2.policy_digest)
+          throw new HttpError(409, "The upload policy changed", {
+            error: "stale_policy"
+          });
+        const overlay = await scanOverlay(id, policy2);
+        const view2 = await api.putView(repo.repository_id, state2.viewKey);
+        if (state2.viewId !== void 0 && state2.viewId !== view2.view_id && view2.repository_id === repo.repository_id && view2.view_key === state2.viewKey) {
+          let removed = false;
+          try {
+            await api.getView(state2.viewId);
+          } catch (error) {
+            if (error instanceof HttpError && error.status === 404)
+              removed = true;
+            else throw error;
+          }
+          if (removed) {
+            delete state2.viewId;
+            delete state2.pending;
+            delete state2.activated;
+          }
+        }
+        if (view2.repository_id !== repo.repository_id || view2.view_key !== state2.viewKey || state2.viewId !== void 0 && state2.viewId !== view2.view_id)
+          throw new CommandError(
+            "The server view does not match this repository/worktree; no source was uploaded."
+          );
+        state2.viewId = view2.view_id;
+        const forgetReplaced = async () => {
+          delete state2.pending;
+          await saveState(path, state2);
+          throw new ReplacedSyncError();
+        };
+        const receipt = async (syncId) => {
+          try {
+            const previous = await api.getSync(view2.view_id, syncId);
+            if (previous.id !== syncId)
+              throw new CommandError("The server returned a different sync; activation remains unverified.");
+            if (previous.state === "receiving") return null;
+            if (!Number.isSafeInteger(previous.version) || previous.version === null || previous.version < 1)
+              throw new CommandError("The server did not return an activation version; retry code status.");
+            return { pending_version: previous.version, state: previous.state };
+          } catch (error) {
+            if (error instanceof HttpError && error.status === 404) {
+              if (withinActivationRetention(state2.pending?.activationAttemptedAt))
+                return forgetReplaced();
+              throw new CommandError("The previous activation can no longer be verified after retention. Check code status before syncing again.");
+            }
+            throw error;
+          }
+        };
+        let current = state2.pending;
+        const matchesCurrent = current && current.digest === overlay.digest && current.request?.mode === "full" && current.request.base_commit === id.commit && current.request.policy_digest === policy2.policy_digest && typeof current.request.client_sync_id === "string" && JSON.stringify(current.request.changes) === JSON.stringify(overlay.changes);
+        if (current?.syncId && current.activationAttemptedAt !== void 0 && !matchesCurrent) {
+          const prior = current;
+          const originalSyncId = current.syncId;
+          let recovered = await receipt(originalSyncId);
+          if (!recovered) {
+            prior.activationAttemptedAt = Date.now();
+            await saveState(path, state2);
+            try {
+              recovered = await api.activate(view2.view_id, originalSyncId);
+            } catch (error) {
+              recovered = await receipt(originalSyncId);
+              if (!recovered) throw error;
+            }
+          }
+          state2.activated = {
+            baseCommit: prior.request.base_commit,
+            overlayDigest: prior.digest,
+            pendingVersion: recovered.pending_version,
+            policyDigest: prior.request.policy_digest
+          };
+          delete state2.pending;
+          await saveState(path, state2);
+          current = void 0;
+        }
+        const request = matchesCurrent && current ? current.request : {
+          client_sync_id: randomUUID2(),
+          base_commit: id.commit,
+          mode: "full",
+          changes: overlay.changes,
+          policy_digest: policy2.policy_digest
+        };
+        state2.pending = current && current.request === request ? current : { digest: overlay.digest, request };
+        await saveState(path, state2);
+        const finish = async (syncId, activated3, uploadedBlobs) => {
+          state2.activated = {
+            baseCommit: id.commit,
+            overlayDigest: overlay.digest,
+            pendingVersion: activated3.pending_version,
+            policyDigest: policy2.policy_digest
+          };
+          delete state2.pending;
+          await saveState(path, state2);
+          return {
+            repository_id: repo.repository_id,
+            repo_key: id.repoKey,
+            org_id: policy2.org_id,
+            view_id: view2.view_id,
+            view_key: state2.viewKey,
+            sync_id: syncId,
+            base_commit: id.commit,
+            base: base2,
+            overlay_digest: overlay.digest,
+            changed_files: overlay.changes.length,
+            uploaded_blobs: uploadedBlobs,
+            excluded: overlay.excluded,
+            warnings: overlay.warnings,
+            policy_restarts: policyRestarts,
+            sync_restarts: syncRestarts,
+            ...activated3
+          };
+        };
+        if (state2.pending.syncId && state2.pending.activationAttemptedAt !== void 0) {
+          const recovered = await receipt(state2.pending.syncId);
+          if (recovered) return finish(state2.pending.syncId, recovered, 0);
+        }
+        const opened2 = await api.openSync(view2.view_id, request);
+        if (opened2.rejected.length)
+          throw new CommandError(
+            `The server refused ${opened2.rejected.length} overlay entries; no sync was activated. Refetch the policy and check the skipped-files report.`
+          );
+        state2.pending.syncId = opened2.sync_id;
+        await saveState(path, state2);
+        if (opened2.state !== "receiving") {
+          const recovered = await receipt(opened2.sync_id);
+          if (recovered) return finish(opened2.sync_id, recovered, 0);
+          throw new CommandError("The server returned an inconsistent sync state; no new version was requested.");
+        }
+        const missing = [...new Set(opened2.missing)];
+        for (const hash2 of missing)
+          if (!overlay.blobs.has(hash2))
+            throw new CommandError(
+              "The server requested an unexpected blob not present in this overlay; no blobs were uploaded."
+            );
+        let activating = false;
+        let activated2;
+        try {
+          let next = 0;
+          let failure;
+          await Promise.all(Array.from({ length: Math.min(4, missing.length) }, async () => {
+            while (!failure && next < missing.length) {
+              const hash2 = missing[next++];
+              try {
+                await api.putBlob(hash2, overlay.blobs.get(hash2));
+              } catch (error) {
+                failure ??= { error };
+              }
+            }
+          }));
+          if (failure) throw failure.error;
+          state2.pending.activationAttemptedAt = Date.now();
+          await saveState(path, state2);
+          activating = true;
+          activated2 = await api.activate(view2.view_id, opened2.sync_id);
+        } catch (error) {
+          const replaced = error instanceof HttpError && (activating ? error.status === 404 : error.status === 409 && error.body["error"] === "unexpected_blob");
+          if (replaced) {
+            if (activating && !withinActivationRetention(state2.pending?.activationAttemptedAt))
+              throw new CommandError("The activation retry exceeded its retention window. Check code status before syncing again.");
+            return forgetReplaced();
+          }
+          const ambiguous = activating && (!(error instanceof HttpError) || error.status >= 500 || error.status === 429);
+          if (ambiguous) {
+            const recovered = await receipt(opened2.sync_id);
+            if (recovered) return finish(opened2.sync_id, recovered, missing.length);
+          }
+          throw error;
+        }
+        return finish(opened2.sync_id, activated2, missing.length);
+      });
+    } catch (error) {
+      if (stale(error) && restart < 2) {
+        policyRestarts++;
+        continue;
+      }
+      if (error instanceof ReplacedSyncError && restart < 2) {
+        syncRestarts++;
+        continue;
+      }
+      throw error;
     }
-  };
-  return resolve(left) === resolve(right);
-}
-function reexecSelf(env, argv2) {
-  const self = argv2[1];
-  if (self === void 0) return 1;
-  const result = spawnSync(process.execPath, [self, ...argv2.slice(2)], {
-    stdio: "inherit",
-    env
-  });
-  if (result.error !== void 0) {
-    process.stderr.write(
-      named(`harness: upgraded, but re-running failed: ${result.error.message}
-`)
+  }
+  throw new CommandError(
+    "The upload policy kept changing. Retry code sync after it settles."
+  );
+}
+async function statusCode(api, options) {
+  const id = await identity(options.cwd);
+  const policy2 = await api.getPolicy();
+  policyScope(policy2);
+  const path = statePath(
+    api.origin,
+    policy2.org_id,
+    id.root,
+    id.repoKey,
+    options.stateDir
+  );
+  const state2 = await readState(
+    path,
+    api.origin,
+    policy2.org_id,
+    id.root,
+    id.repoKey
+  );
+  const repository = options.skipped ? await api.putRepository(id.repoKey) : void 0;
+  if (repository && repository.repo_key !== id.repoKey)
+    throw new CommandError(
+      "The server resolved a different repository; its base status cannot be trusted."
     );
-    return 1;
+  const repositoryId = repository?.repository_id ?? state2?.repositoryId;
+  if (!state2?.viewId || repository && repositoryId !== state2.repositoryId) {
+    const base3 = options.skipped && repositoryId ? await api.getBase(repositoryId, id.commit, true) : void 0;
+    return {
+      state: base3?.state === "failed" ? "failed" : base3?.state === "fetching" ? "fetching" : "not_synced",
+      org_id: policy2.org_id,
+      repo_key: id.repoKey,
+      base_commit: id.commit,
+      ...base3 ? { base: base3 } : {}
+    };
   }
-  return result.status ?? 1;
+  const view2 = await api.getView(state2.viewId);
+  if (view2.repository_id !== state2.repositoryId || view2.view_id !== state2.viewId || view2.view_key !== state2.viewKey)
+    throw new CommandError(
+      "The server view does not match this repository/worktree; its status cannot be trusted."
+    );
+  const overlay = await scanOverlay(id, policy2);
+  const current = view2.active?.base_commit === id.commit && view2.active.overlay_digest === overlay.digest && state2.activated?.baseCommit === view2.active.base_commit && state2.activated.overlayDigest === view2.active.overlay_digest && state2.activated.pendingVersion === view2.active.version && state2.activated.policyDigest === policy2.policy_digest;
+  const base2 = options.skipped && state2.repositoryId ? await api.getBase(state2.repositoryId, id.commit, true) : void 0;
+  return {
+    state: base2?.state === "failed" || view2.pending?.state === "failed" ? "failed" : current ? "current" : view2.pending ? "pending" : "stale",
+    org_id: policy2.org_id,
+    repo_key: id.repoKey,
+    base_commit: id.commit,
+    ...view2,
+    local_overlay_digest: overlay.digest,
+    excluded: overlay.excluded,
+    warnings: overlay.warnings,
+    ...base2 ? { base: base2 } : {}
+  };
 }
-function takeLock(env) {
-  const path = join2(resolveCacheHome(env), "harness", "upgrade.lock");
-  const temporary = `${path}.${process.pid}.tmp`;
+
+// src/core/code/query.ts
+import { z as z2 } from "zod";
+var hash = z2.string().regex(/^[0-9a-f]{64}$/);
+var queryView = z2.object({
+  view_id: z2.string().uuid(),
+  repository_id: z2.string().uuid(),
+  view_key: z2.string().min(1),
+  active: z2.object({ version: z2.number().int().positive(), base_commit: z2.string().regex(/^[0-9a-f]{40}$/), overlay_digest: hash }).passthrough(),
+  pending: z2.object({ version: z2.number().int(), state: z2.string(), progress: z2.object({ done: z2.number().int().nonnegative(), total: z2.number().int().nonnegative() }).nullable().optional() }).passthrough().nullable()
+}).passthrough();
+var envelopeSchema = z2.object({
+  data: z2.unknown(),
+  meta: z2.object({ contract: z2.literal("1.3"), view: queryView, truncation: z2.object({ truncated: z2.boolean() }).passthrough() }).passthrough()
+}).passthrough();
+var citationSchema = z2.object({ path: z2.string().min(1), start_line: z2.number().int().positive(), end_line: z2.number().int().positive(), sha256: hash, version: z2.number().int().positive(), from: z2.enum(["base", "overlay"]), snippet: z2.string().optional() }).passthrough();
+var record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var shell = (text) => "'" + text.replaceAll("'", "'\\''") + "'";
+function fail() {
+  throw new CommandError("The code query API returned an invalid contract 1.3 response; no result was presented.");
+}
+function integer(value, name, min, max) {
+  if (value !== void 0 && (!Number.isSafeInteger(value) || value < min || value > max)) throw new UsageError(`${name} must be an integer from ${min} to ${max}.`);
+}
+function validateQuery(operation, p) {
+  const texts = [p.q, p.symbol, p.kind, p.pathPrefix, ...p.symbols ?? [], ...p.files ?? []];
+  if (texts.some((s) => s !== void 0 && (typeof s !== "string" || s.length === 0 || Buffer.byteLength(s) > 8192 || /[\x00-\x1f\x7f-\x9f]/.test(s) || Buffer.from(s).toString("utf8") !== s))) throw new UsageError("Code query arguments must be nonempty UTF-8 text without control characters (at most 8 KiB each).");
+  if (operation === "search" && !p.q?.trim()) throw new UsageError("usage: harness code search <query>");
+  if (operation === "explain" && !p.symbol) throw new UsageError("usage: harness code explain <symbol-id>");
+  if (operation === "context" && Number(Boolean(p.symbol)) + Number(Boolean(p.q?.trim())) !== 1) throw new UsageError("code context requires exactly one query or --symbol.");
+  if (operation === "affected") {
+    const seeds = (p.symbols?.length ?? 0) + (p.files?.length ?? 0);
+    if (seeds < 1 || seeds > 200) throw new UsageError("code affected needs 1 to 200 --symbol/--file seeds.");
+    if (Buffer.byteLength(JSON.stringify(p)) > 24e4) throw new UsageError("Code affected seeds exceed the request size limit; narrow the selection.");
+  }
+  integer(p.limit, "limit", 1, 100);
+  integer(p.depth, "depth", 1, 6);
+  integer(p.budgetTokens, "budget-tokens", 100, operation === "context" ? 32e3 : 16e3);
+}
+function command(op, p) {
+  const parts = ["harness", "code", op];
+  if (p.q !== void 0) parts.push(shell(p.q));
+  if (op === "explain" && p.symbol) parts.push(shell(p.symbol));
+  else if (p.symbol) parts.push("--symbol", shell(p.symbol));
+  for (const id of p.symbols ?? []) parts.push("--symbol", shell(id));
+  for (const file of p.files ?? []) parts.push("--file", shell(file));
+  for (const [key, value] of [["limit", p.limit], ["depth", p.depth], ["budget-tokens", p.budgetTokens], ["kind", p.kind], ["path-prefix", p.pathPrefix]])
+    if (value !== void 0) parts.push(`--${key}`, typeof value === "number" ? String(value) : shell(value));
+  if (p.includeAmbiguous) parts.push("--include-ambiguous");
+  if (p.includeTypes) parts.push("--include-types");
+  if (p.worktree) parts.push("--path", shell(p.worktree));
+  return named(parts.join(" "));
+}
+function nextCommand(op, p, next) {
+  if (!record(next)) return null;
+  const updated = { ...p };
+  let changed = false;
+  for (const [key, field] of [["limit", "limit"], ["depth", "depth"], ["budget_tokens", "budgetTokens"]]) {
+    if (key === "limit" && op !== "search" || key === "depth" && op !== "affected" || key === "budget_tokens" && op !== "explain" && op !== "context") continue;
+    if (typeof next[key] === "number") {
+      updated[field] = next[key];
+      changed = true;
+    }
+  }
+  if (!changed) return null;
   try {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(temporary, `${process.pid}
-`);
+    validateQuery(op, updated);
   } catch {
     return null;
   }
+  return command(op, updated);
+}
+function renderQuery(operation, params, raw) {
+  const parsed = envelopeSchema.safeParse(raw);
+  if (!parsed.success) fail();
+  const response = parsed.data;
+  if (operation === "search" ? !Array.isArray(response.data) : !record(response.data)) fail();
+  const { view: view2, truncation } = response.meta;
+  const guidance = [];
+  const lines = [`View ${view2.view_id}: version ${view2.active.version}; base ${view2.active.base_commit}; overlay ${view2.active.overlay_digest}`];
+  if (view2.pending) lines.push(`Pending version ${view2.pending.version}: ${clean(view2.pending.state)}${view2.pending.progress ? ` (${view2.pending.progress.done}/${view2.pending.progress.total})` : ""}`);
+  let visited = 0;
+  const buckets = {};
+  const walk = (value, label3, depth, enclosingSymbol, countBuckets = true) => {
+    if (++visited > 1e5 || depth > 32) fail();
+    if (record(value)) {
+      const symbol = typeof value["symbol_id"] === "string" ? value["symbol_id"] : enclosingSymbol;
+      if ("path" in value && "start_line" in value && "sha256" in value) {
+        const citation = citationSchema.safeParse(value);
+        if (!citation.success || citation.data.end_line < citation.data.start_line || citation.data.version !== view2.active.version) fail();
+        const c = citation.data;
+        lines.push(`${label3}: ${clean(c.path)}:${c.start_line}${c.end_line === c.start_line ? "" : `-${c.end_line}`}@${c.sha256} [${c.from}, version ${c.version}]`);
+        const context = command("context", { ...symbol || params.symbol ? { symbol: symbol ?? params.symbol } : { q: params.q ?? "symbol name" }, worktree: params.worktree });
+        lines.push(c.snippet !== void 0 ? c.snippet.split("\n").map(clean).join("\n") : `Snippet not supplied; retrieve indexed text: ${context}`);
+        for (const [key, extra] of Object.entries(value)) if (!["path", "start_line", "end_line", "sha256", "version", "from", "snippet"].includes(key)) walk(extra, `${label3}.${clean(key)}`, depth + 1, symbol, countBuckets);
+      } else for (const [key, child] of Object.entries(value)) walk(child, `${label3}.${clean(key)}`, depth + 1, symbol, countBuckets);
+    } else if (Array.isArray(value)) {
+      if (countBuckets && label3 !== "data") buckets[label3.slice(5)] = value.length;
+      if (!value.length) lines.push(`${label3}: []`);
+      value.forEach((v, i) => walk(v, `${label3}[${i}]`, depth + 1, enclosingSymbol, false));
+    } else lines.push(`${label3}: ${clean(typeof value === "string" ? value : JSON.stringify(value))}`);
+  };
+  walk(response.data, "data", 0);
+  const counts = Array.isArray(response.data) ? response.data.length : buckets;
+  const total = typeof truncation["total"] === "number" ? truncation["total"] : response.meta["total"];
+  lines.push(`Truncated: ${truncation.truncated ? "yes" : "no"}; returned: ${JSON.stringify(counts)}; total: ${typeof total === "number" ? total : "unknown (not supplied by server)"}`);
+  if (truncation.truncated) {
+    lines.push(`Truncation metadata: ${JSON.stringify(truncation)}`);
+    const next = nextCommand(operation, params, truncation["next"]);
+    guidance.push(next ? `Next: ${next}` : `Next: narrow the query or use rg -n; ${typeof truncation["hint"] === "string" ? clean(truncation["hint"]) : "the server supplied no larger request."}`);
+  }
+  const coverage = record(response.data) ? response.data["not_tracked"] : void 0;
+  if (Array.isArray(coverage) && coverage.length) {
+    for (const entry of coverage) if (record(entry)) guidance.push(`Coverage${entry["partial"] === true ? " (partial)" : ""}: ${clean(entry["reason"])}`);
+  }
+  if (Array.isArray(coverage) && coverage.length || Array.isArray(response.data) && response.data.length === 0) {
+    const symbol = record(response.data) && record(response.data["symbol"]) ? response.data["symbol"]["name"] : void 0;
+    guidance.push(`Search locally: rg -n --fixed-strings -- ${shell(params.q ?? (typeof symbol === "string" ? symbol : "symbol name"))} .`);
+  }
+  return { json: { ...response, guidance }, human: lines.concat(guidance).join("\n") + "\n" };
+}
+async function queryCode(api, operation, params, options) {
+  validateQuery(operation, params);
+  const id = await identity(options.cwd);
+  const policy2 = await api.getPolicy();
+  if (!z2.string().uuid().safeParse(policy2.org_id).success) fail();
+  const path = statePath(api.origin, policy2.org_id, id.root, id.repoKey, options.stateDir);
+  const state2 = await readState(path, api.origin, policy2.org_id, id.root, id.repoKey);
+  if (!state2?.viewId || !state2.repositoryId) throw new CommandError(`This worktree has no code view. Run harness code sync --path ${shell(id.root)} first.`);
+  const view2 = await api.getView(state2.viewId);
+  const matches = (v) => v.view_id === state2.viewId && v.repository_id === state2.repositoryId && v.view_key === state2.viewKey;
+  if (!matches(view2)) throw new CommandError("The code view does not match this repository/worktree; no query was sent.");
+  if (!view2.active) throw new CommandError(`The view has no indexed version yet. Check harness code status --path ${shell(id.root)} until indexing finishes.`);
   try {
-    for (let attempt = 0; attempt < 2; attempt++) {
-      try {
-        linkSync(temporary, path);
-        return { path, pid: process.pid };
-      } catch {
-        const holder = readHolder(path);
-        if (holder === null) continue;
-        const aged = Date.now() - holder.mtimeMs > LOCK_STALE_MS;
-        const abandoned = holder.pid === null ? aged : !running(holder.pid) || aged;
-        if (!abandoned) return null;
-        try {
-          rmSync(path, { force: true });
-        } catch {
-          return null;
-        }
-      }
-    }
-    return null;
-  } finally {
-    try {
-      rmSync(temporary, { force: true });
-    } catch {
-    }
+    const raw = await api.query(state2.viewId, operation, params);
+    const result = renderQuery(operation, { ...params, worktree: id.root }, raw);
+    if (!matches(result.json.meta.view)) throw new CommandError("The query view does not match this repository/worktree; no result was presented.");
+    return result;
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404 && operation !== "search") throw new CommandError(`The code symbol or view was not found. Search again with ${command("search", { q: "symbol name", worktree: id.root })}; symbol IDs are opaque and can change after edits. Check code status for a removed view.`);
+    throw error;
   }
 }
-function releaseLock(lock) {
+
+// src/commands/code/index.ts
+function enterWorktree(options) {
+  const cwd = process.cwd();
+  const before = statSync(".");
+  const declared = statSync(cwd);
+  if (before.dev !== declared.dev || before.ino !== declared.ino)
+    throw new LocalError("Cannot enter the code worktree safely.");
+  const supplied = options.path ?? cwd;
+  if (/[\x00-\x1f\x7f-\x9f]/.test(supplied) || Buffer.from(supplied, "utf8").toString("utf8") !== supplied || options.path !== void 0 && supplied.includes("\uFFFD"))
+    throw new LocalError("Cannot enter the code worktree safely.");
+  const path = resolve2(supplied);
   try {
-    if (readHolder(lock.path)?.pid !== lock.pid) return;
-    rmSync(lock.path, { force: true });
+    const target = statSync(path);
+    if (options.path === void 0 && (before.dev !== target.dev || before.ino !== target.ino))
+      throw new Error("current directory identity changed");
+    process.chdir(path);
+    const entered = statSync(".");
+    if (entered.dev !== target.dev || entered.ino !== target.ino)
+      throw new Error("worktree identity changed");
   } catch {
+    throw new LocalError("Cannot enter the code worktree; check --path.");
   }
+  return { ...options, path };
 }
-function readHolder(path) {
+async function sync(ctx, options = {}) {
   try {
-    const mtimeMs = statSync(path).mtimeMs;
-    const pid = Number.parseInt(readFileSync(path, "utf8").trim(), 10);
-    return { pid: Number.isInteger(pid) && pid > 0 ? pid : null, mtimeMs };
-  } catch {
-    return null;
+    const result = await syncCode(new HttpCodeApi(ctx.config), {
+      cwd: options.path ?? process.cwd(),
+      skipped: options.skipped
+    });
+    return {
+      json: result,
+      exitCode: result.state === "failed" ? 1 : 0,
+      human: `${clean(result.repo_key)}: ${clean(result.state)} version ${result.pending_version}; uploaded ${result.uploaded_blobs} overlay blobs.
+View: ${result.view_id}
+${result.excluded.length} overlay files skipped; ${result.base.excluded_count ?? 0} base files skipped.${options.skipped ? "\n" + (result.base.skipped ?? []).map((s) => `${clean(s.path)}: ${clean(s.reason)}`).join("\n") : ""}
+${result.warnings.map((w) => `Warning: ${clean(w)}
+`).join("")}`
+    };
+  } catch (error) {
+    throw error instanceof HttpError ? describeCodeError(error) : error;
   }
 }
-function running(pid) {
-  if (pid === null) return false;
+async function status2(ctx, options = {}) {
   try {
-    process.kill(pid, 0);
-    return true;
+    const result = await statusCode(new HttpCodeApi(ctx.config), {
+      cwd: options.path ?? process.cwd(),
+      skipped: options.skipped
+    });
+    const report = "base" in result ? result.base : void 0;
+    const pending = "pending" in result ? result.pending : null;
+    const serverError = pending?.error ?? report?.error;
+    const failure = serverError && typeof serverError === "object" && "message" in serverError && typeof serverError.message === "string" ? clean(serverError.message) : "";
+    return {
+      json: result,
+      exitCode: result.state === "failed" ? 1 : 0,
+      human: `${clean(result.repo_key)}: ${result.state.replace("_", " ")}${failure ? ": " + failure : ""}
+${report?.skipped?.map((s) => `${clean(s.path)}: ${clean(s.reason)}
+`).join("") ?? ""}${("warnings" in result ? result.warnings : [])?.map((w) => `Warning: ${clean(w)}
+`).join("") ?? ""}`
+    };
   } catch (error) {
-    return error.code === "EPERM";
+    throw error instanceof HttpError ? describeCodeError(error) : error;
   }
 }
-function truthy(value) {
-  if (value === void 0) return false;
-  const normalized = value.trim().toLowerCase();
-  return normalized !== "" && normalized !== "0" && normalized !== "false" && normalized !== "no";
-}
-function checksEnabled(env) {
-  return !truthy(env["CI"]) && !truthy(env["HARNESS_NO_UPDATE_CHECK"]);
-}
-function autoUpgradeEnabled(env) {
-  if (!checksEnabled(env)) return false;
-  const explicit = env["HARNESS_AUTO_UPGRADE"];
-  if (explicit !== void 0 && explicit.trim() !== "") return truthy(explicit);
-  return true;
+async function query(ctx, operation, params, options = {}) {
+  try {
+    return await queryCode(new HttpCodeApi(ctx.config), operation, params, { cwd: options.path ?? process.cwd() });
+  } catch (error) {
+    throw error instanceof HttpError ? describeCodeError(error) : error;
+  }
 }
 
 // src/cli.ts
 function promptLine(question) {
-  const readline = createInterface2({
+  const readline = createInterface({
     input: process.stdin,
     output: process.stderr
   });
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     readline.question(question, (answer) => {
       readline.close();
-      resolve(answer);
+      resolve3(answer);
     });
   });
 }
-function exitWith(code) {
-  const drain = (stream) => new Promise((resolve) => stream.write("", () => resolve()));
+function exitWith(code2) {
+  const drain = (stream) => new Promise((resolve3) => stream.write("", () => resolve3()));
   return Promise.all([drain(process.stdout), drain(process.stderr)]).then(
-    () => process.exit(code)
+    () => process.exit(code2)
   );
 }
 guardBrokenPipes();
@@ -1525,13 +2176,13 @@ program.name(invokedAs).description(
   writeOut: (text) => process.stdout.write(named(text, invokedAs)),
   writeErr: (text) => writeStderr(text)
 });
-function integer(value) {
+function integer2(value) {
   if (!/^\d+$/.test(value))
     throw new InvalidArgumentError("expected a non-negative integer");
   return Number.parseInt(value, 10);
 }
 function activityLimit(value) {
-  const limit = integer(value);
+  const limit = integer2(value);
   if (limit < 1 || limit > ACTIVITY_MAX_LIMIT) {
     throw new InvalidArgumentError(
       `expected an integer from 1 to ${ACTIVITY_MAX_LIMIT}`
@@ -1564,7 +2215,23 @@ function interactive() {
   const ci = process.env["CI"];
   return process.stdout.isTTY === true && (ci === void 0 || ci === "");
 }
-async function withConfig(jsonFlag, mutating, run2) {
+function canConfirmRepoLogin() {
+  return process.stdin.isTTY === true && process.stderr.isTTY === true;
+}
+async function confirmRepoLogin(baseUrl, source, path) {
+  if (source !== "repo-config" || isHostTrusted(baseUrl)) return true;
+  const answer = await promptLine(
+    `This repo's config (${path ?? ".harness-cli/config.json"}) targets ${baseUrl} \u2014 log in there? [y/N] `
+  );
+  if (answer.trim().toLowerCase() !== "y") {
+    writeStderr(`harness: not logging in to ${baseUrl} \u2014 set HARNESS_API_URL to override the repo config
+`);
+    return false;
+  }
+  trustHost(baseUrl);
+  return true;
+}
+async function withConfig(jsonFlag, mutating, run3) {
   const resolved = resolveConfig();
   for (const warning of resolved.warnings) writeStderr(warning + "\n");
   if (resolved.kind === "error") {
@@ -1575,22 +2242,14 @@ async function withConfig(jsonFlag, mutating, run2) {
   if (resolved.kind === "needs-login") {
     if (!interactive()) {
       writeStderr(loginHelp(resolved.baseUrl));
+      if (resolved.org !== void 0) writeStderr(`Choose organization ${resolved.org} when logging in.
+`);
       return exitWith(2);
     }
-    if (resolved.hostSource === "repo-config" && !isHostTrusted(resolved.baseUrl)) {
-      const answer = await promptLine(
-        `This repo's config (${resolved.repoConfigPath ?? ".harness-cli/config.json"}) targets ${resolved.baseUrl} \u2014 log in there? [y/N] `
-      );
-      if (answer.trim().toLowerCase() !== "y") {
-        writeStderr(
-          `harness: not logging in to ${resolved.baseUrl} \u2014 set HARNESS_API_URL to override the repo config
-`
-        );
-        return exitWith(2);
-      }
-      trustHost(resolved.baseUrl);
+    if (!await confirmRepoLogin(resolved.baseUrl, resolved.hostSource, resolved.repoConfigPath)) {
+      return exitWith(2);
     }
-    const loginResult = await login(resolved.baseUrl, {});
+    const loginResult = await login(resolved.baseUrl, resolved.org === void 0 ? {} : { org: resolved.org });
     if (!loginResult.ok) {
       writeStderr(`harness: ${clean(loginResult.message)}
 `);
@@ -1605,25 +2264,25 @@ async function withConfig(jsonFlag, mutating, run2) {
       );
       return exitWith(1);
     }
-    return execute(again.config, jsonFlag, mutating, run2);
+    return execute(again.config, jsonFlag, mutating, run3);
   }
-  return execute(resolved.config, jsonFlag, mutating, run2);
+  return execute(resolved.config, jsonFlag, mutating, run3);
 }
-async function execute(config, jsonFlag, mutating, run2) {
+async function execute(config, jsonFlag, mutating, run3) {
   const client = new Client(config);
   const hostNotice = mutating ? `\u2192 ${config.baseUrl}
 ` : "";
   try {
-    const output = await run2({ client, config });
+    const output = await run3({ client, config });
     writeStderr(hostNotice);
     if (output.notice !== void 0) writeStderr(output.notice);
     process.stdout.write(jsonFlag ? json(output.json) : output.human);
     return exitWith(output.exitCode ?? (output.partial === true ? 1 : 0));
   } catch (error) {
-    return fail(explainExpertRefusal(error, config.token), hostNotice);
+    return fail2(explainExpertRefusal(error, config.token), hostNotice);
   }
 }
-async function fail(error, hostNotice) {
+async function fail2(error, hostNotice) {
   if (error instanceof UsageError) {
     writeStderr(error.message + "\n");
     return exitWith(2);
@@ -1667,7 +2326,7 @@ async function fail(error, hostNotice) {
 program.command("ready").description("issues ready to work, highest priority first").option(
   "--claim",
   "claim the team's next ready, unassigned issue in one server-side request (team from --team, HARNESS_TEAM or the repo config; no paging flags)"
-).option("--team <key>", "team filter; with --claim, the team to claim from").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+).option("--team <key>", "team filter; with --claim, the team to claim from").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   if (opts.claim === true) requireReadyClaimArgs(opts);
   await withConfig(
     opts.json === true,
@@ -1675,7 +2334,7 @@ program.command("ready").description("issues ready to work, highest priority fir
     (ctx) => ready(ctx, opts)
   );
 });
-program.command("blocked").description("issues waiting on a blocker").option("--team <key>", "team filter").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+program.command("blocked").description("issues waiting on a blocker").option("--team <key>", "team filter").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
@@ -1688,7 +2347,7 @@ program.command("list").description("list issues with filters").option("--status
 ).option("--created-by <who>", "me or a creator user id").option(
   "--involved <who>",
   "me for issues created by, assigned to, or mentioning you"
-).option("--priority <name>", "urgent | high | medium | low | none").option("--label <name>", "label filter").option("--type <type>", "task | bug | feature | epic").option("--search <query>", "full-text search").option("--team <key>", "team filter").option("--parent <id>", "children of an epic").option("--scope <scope>", "all | archived").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+).option("--priority <name>", "urgent | high | medium | low | none").option("--label <name>", "label filter").option("--type <type>", "task | bug | feature | epic").option("--search <query>", "full-text search").option("--team <key>", "team filter").option("--parent <id>", "children of an epic").option("--scope <scope>", "all | archived").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
@@ -1697,16 +2356,16 @@ program.command("list").description("list issues with filters").option("--status
 });
 program.command("search").description(
   "search by meaning \u2014 ranked, exact identifier first; use list --search for paginated filtering"
-).argument("[query...]").option("--limit <n>", "maximum results (default 10, capped at 20)", integer).option(
+).argument("[query...]").option("--limit <n>", "maximum results (default 10, capped at 20)", integer2).option(
   "--page <n>",
   "(deprecated, ignored \u2014 results are ranked and capped)",
-  integer
+  integer2
 ).option("--all", "(deprecated, ignored \u2014 results are ranked and capped)").option("--json", "emit JSON").action(
-  async (query, opts) => {
+  async (query2, opts) => {
     await withConfig(
       opts.json === true,
       false,
-      (ctx) => search(ctx, query, opts)
+      (ctx) => search(ctx, query2, opts)
     );
   }
 );
@@ -1926,32 +2585,37 @@ plan.command("create").description("create a plan from a JSON or YAML file (the
     return planCreate(ctx, readPlanFile(opts.file), { ...opts, team: team2 });
   });
 });
-plan.command("show").description("a plan's status, budgets, revision, steps, edges and wait conditions").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+plan.command("list").description("a team's plans, newest first: root, status, held, revision and title").option("--team <key>", "the team whose issues root the plans (or HARNESS_TEAM)").option("--status <status>", PLAN_STATUSES.join(" | ")).option("--limit <n>", `maximum plans (default 50, at most ${PLAN_LIST_MAX_LIMIT}; there are no pages)`, integer2).option("--json", "emit JSON").action(async (opts) => {
+  requirePlanListArgs(opts);
+  await withConfig(opts.json === true, false, (ctx) => planList(ctx, opts));
+});
+var PLAN_ARGUMENT = "the plan's id, or its root issue's identifier (e.g. FR-1)";
+plan.command("show").description("a plan's status, budgets, revision, steps, edges and wait conditions").argument("[plan]", PLAN_ARGUMENT).option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, false, (ctx) => {
-    if (id === void 0) throw new UsageError("usage: harness plan show <plan-id>");
+    if (id === void 0) throw new UsageError("usage: harness plan show <plan-id-or-root>");
     return planShow(ctx, id);
   });
 });
-plan.command("edit").description("change step executors and keys, and budgets, from a JSON or YAML file").argument("[id]").option("--file <path>", 'the edit: .json is JSON, anything else YAML ("-" for stdin)').option("--json", "emit JSON").action(async (id, opts) => {
+plan.command("edit").description("change step executors and keys, and budgets, from a JSON or YAML file").argument("[plan]", PLAN_ARGUMENT).option("--file <path>", 'the edit: .json is JSON, anything else YAML ("-" for stdin)').option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => {
     if (id === void 0 || opts.file === void 0) {
-      throw new UsageError("usage: harness plan edit <plan-id> --file <edits.json|edits.yaml>");
+      throw new UsageError("usage: harness plan edit <plan-id-or-root> --file <edits.json|edits.yaml>");
     }
-    requirePlanId(id);
+    requirePlanRef(id);
     return planEdit(ctx, id, readPlanFile(opts.file));
   });
 });
-plan.command("release").description("release a plan as yourself: freeze its next revision and let its ready steps run").argument("[id]").option("--collaborator <who>", "a person of this organization (id or email) for the plan room (repeatable)", collect, []).option("--retry-budget <n>", "retries per failed Operator step", integer).option("--spend-budget-cents <n>", "the plan's spend budget; needed to release Operator steps", integer).option("--json", "emit JSON").action(
+plan.command("release").description("release a plan as yourself: freeze its next revision and let its ready steps run").argument("[plan]", PLAN_ARGUMENT).option("--collaborator <who>", "a person of this organization (id or email) for the plan room (repeatable)", collect, []).option("--retry-budget <n>", "retries per failed Operator step", integer2).option("--spend-budget-cents <n>", "the plan's spend budget; needed to release Operator steps", integer2).option("--json", "emit JSON").action(
   async (id, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
-      if (id === void 0) throw new UsageError("usage: harness plan release <plan-id>");
+      if (id === void 0) throw new UsageError("usage: harness plan release <plan-id-or-root>");
       return planRelease(ctx, id, { ...opts, collaborators: opts.collaborator });
     });
   }
 );
-plan.command("hold").description("pause every step of a plan until it is released again").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+plan.command("hold").description("pause every step of a plan until it is released again").argument("[plan]", PLAN_ARGUMENT).option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => {
-    if (id === void 0) throw new UsageError("usage: harness plan hold <plan-id>");
+    if (id === void 0) throw new UsageError("usage: harness plan hold <plan-id-or-root>");
     return planHold(ctx, id);
   });
 });
@@ -1982,7 +2646,7 @@ var NO_OBJECTIVE_TEXT = "By reference only: never the objective's text, which th
 program.command("jobs").description("Operator jobs you see in the workbench, newest first").option(
   "--status <states>",
   `comma-separated job states (${JOB_STATES.join(", ")}) or open | waiting | done`
-).option("--mine", "only jobs you own").option(`--limit <n>`, `jobs per page (default 20, max ${JOBS_MAX_LIMIT})`, integer).option("--all", `follow every page (up to ${JOBS_MAX_PAGES})`).option("--json", "emit JSON").addHelpText("after", `
+).option("--mine", "only jobs you own").option(`--limit <n>`, `jobs per page (default 20, max ${JOBS_MAX_LIMIT})`, integer2).option("--all", `follow every page (up to ${JOBS_MAX_PAGES})`).option("--json", "emit JSON").addHelpText("after", `
 ${NO_OBJECTIVE_TEXT}
 `).action(async (opts) => {
   requireJobsArgs(opts);
@@ -1999,7 +2663,7 @@ ${NO_OBJECTIVE_TEXT}
     (ctx) => jobShow(ctx, id, { changes: opts.changes, people: opts.people })
   );
 });
-program.command("watch").description("follow an Operator job until it completes, fails, or waits for a person").argument("[id]").option("--after <seq>", "start after this event sequence (default 0: the whole history)", integer).option("--through-waits", "keep following while a person has to act, instead of stopping").option("--json", "emit one JSON document when the watch ends").addHelpText(
+program.command("watch").description("follow an Operator job until it completes, fails, or waits for a person").argument("[id]").option("--after <seq>", "start after this event sequence (default 0: the whole history)", integer2).option("--through-waits", "keep following while a person has to act, instead of stopping").option("--json", "emit one JSON document when the watch ends").addHelpText(
   "after",
   `
 Polls the job's events every 2 s, and every 10 s while the job is paused or
@@ -2220,7 +2884,7 @@ program.command("attach-image").description("upload an image; prints markdown to
   });
 });
 var project = program.command("project").description("projects");
-project.command("list").option("--search <query>", "full-text search").option("--state <state>", "project state filter").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+project.command("list").option("--search <query>", "full-text search").option("--state <state>", "project state filter").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
@@ -2268,7 +2932,7 @@ milestone.command("create").option("--project <id>", "project id (required)").op
   );
 });
 var doc = program.command("doc").description("documents");
-doc.command("list").option("--search <query>", "full-text search").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+doc.command("list").option("--search <query>", "full-text search").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
@@ -2347,15 +3011,15 @@ link.command("rm").argument("[issue]").argument("[id-or-url]").option("--json",
     });
   }
 );
-var label = program.command("label").description("labels");
-label.command("list").option("--json", "emit JSON").action(async (opts) => {
+var label2 = program.command("label").description("labels");
+label2.command("list").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
     (ctx) => labelList(ctx)
   );
 });
-label.command("create").argument("[name]").option("--color <color>", "label color").option("--json", "emit JSON").action(
+label2.command("create").argument("[name]").option("--color <color>", "label color").option("--json", "emit JSON").action(
   async (name, opts) => {
     await withConfig(
       opts.json === true,
@@ -2364,10 +3028,10 @@ label.command("create").argument("[name]").option("--color <color>", "label colo
     );
   }
 );
-label.command("update").description("rename or recolor a label").argument("[id]").option("--name <name>", "new name").option("--color <color>", "swatch name (red, blue, \u2026) or a hex code").option("--json", "emit JSON").action(async (id, opts) => {
+label2.command("update").description("rename or recolor a label").argument("[id]").option("--name <name>", "new name").option("--color <color>", "swatch name (red, blue, \u2026) or a hex code").option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => labelUpdate(ctx, id, opts));
 });
-label.command("delete").description("delete a label (refused while issues carry it)").argument("[id]").option("--yes", "confirm the deletion").option("--json", "emit JSON").action(async (id, opts) => {
+label2.command("delete").description("delete a label (refused while issues carry it)").argument("[id]").option("--yes", "confirm the deletion").option("--json", "emit JSON").action(async (id, opts) => {
   await withConfig(opts.json === true, true, (ctx) => labelDelete(ctx, id, opts));
 });
 var team = program.command("team").description("teams");
@@ -2452,14 +3116,14 @@ var tools = program.command("tools").description(
   requireToolsOpts(opts);
   await withConfig(opts.json === true, false, (ctx) => toolsList(ctx, opts));
 });
-tools.command("search").description("search what Operator can use now by keyword, best match first").argument("[query...]").option("--domain <domain>", "only this domain").option("--cursor <cursor>", "continue from a page's cursor (from the paging notice)").option("--all", "follow every page").option("--json", "emit JSON").action(async (query, opts) => {
+tools.command("search").description("search what Operator can use now by keyword, best match first").argument("[query...]").option("--domain <domain>", "only this domain").option("--cursor <cursor>", "continue from a page's cursor (from the paging notice)").option("--all", "follow every page").option("--json", "emit JSON").action(async (query2, opts) => {
   const merged = { ...tools.opts(), ...opts };
-  if (query.length === 0) {
+  if (query2.length === 0) {
     throw new UsageError("usage: harness tools search <query> [--domain <domain>] [--all]");
   }
-  requireSearchQuery(query.join(" "));
+  requireSearchQuery(query2.join(" "));
   requireToolsOpts(merged);
-  await withConfig(merged.json === true, false, (ctx) => toolsSearch(ctx, query.join(" "), merged));
+  await withConfig(merged.json === true, false, (ctx) => toolsSearch(ctx, query2.join(" "), merged));
 });
 tools.command("domains").description("every domain Operator can use capabilities in, with how many").option("--json", "emit JSON").action(async (opts) => {
   const parent = tools.opts();
@@ -2478,7 +3142,7 @@ program.command("skills").description("the organization's skills assigned to Ope
   await withConfig(opts.json === true, false, (ctx) => skillsList(ctx));
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-KVRQBVXI.js");
+  const { startMcpServer } = await import("./server-TRXBTJSA.js");
   await startMcpServer(invokedAs);
 });
 var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
@@ -2492,38 +3156,99 @@ keys.command("exec").description(
   "pass only these provider slugs (comma-separated, repeatable); default: everything stored",
   collect,
   []
-).option("--json", "accepted for uniformity; stdout belongs to the command, so it changes nothing").passThroughOptions().action(async (command, opts) => {
+).option("--json", "accepted for uniformity; stdout belongs to the command, so it changes nothing").passThroughOptions().action(async (command2, opts) => {
   const only = opts.only.flatMap((value) => value.split(","));
   await withConfig(
     false,
     false,
-    (ctx) => exec(ctx, { command, override: opts.override === true, only })
+    (ctx) => exec(ctx, { command: command2, override: opts.override === true, only })
   );
 });
+var code = program.command("code").description("sync and inspect a code-index worktree overlay");
+code.command("sync").description("sync an overlay on a server-built GitHub base (needs harness:read and harness:write)").option("--path <directory>", "Git worktree (defaults to the current directory)").option("--skipped", "include the server base\u2019s skipped-files report").option("--json", "emit JSON").action(async (opts) => {
+  const target = enterWorktree(opts);
+  await withConfig(opts.json === true, true, (ctx) => sync(ctx, target));
+});
+code.command("status").description("inspect this worktree view; --skipped also asks for base status (needs harness:write)").option("--path <directory>", "Git worktree (defaults to the current directory)").option("--skipped", "include the server base\u2019s skipped-files report").option("--json", "emit JSON").action(async (opts) => {
+  const target = enterWorktree(opts);
+  await withConfig(opts.json === true, opts.skipped === true, (ctx) => status2(ctx, target));
+});
+for (const operation of ["search", "explain", "affected", "context"]) {
+  const query2 = code.command(operation).description({ search: "find indexed declarations", explain: "explain an opaque symbol ID and its callers", affected: "find impact from symbol IDs or file paths", context: "retrieve indexed source snippets within a token budget" }[operation]);
+  if (operation === "search" || operation === "explain" || operation === "context") query2.argument("[value]");
+  if (operation === "search") query2.option("--kind <kind>").option("--path-prefix <prefix>").option("--limit <n>", "1 to 100", integer2);
+  if (operation === "context") query2.option("--symbol <id>", "opaque ID from search");
+  if (operation === "context" || operation === "explain") query2.option("--budget-tokens <n>", "indexed snippet token budget", integer2);
+  if (operation === "affected") query2.option("--symbol <id>", "repeat for multiple IDs", (value, all) => [...all, value], []).option("--file <path>", "repeat for multiple paths", (value, all) => [...all, value], []).option("--depth <n>", "1 to 6", integer2).option("--include-ambiguous", "follow possible bindings too").option("--include-types", "follow type dependents too");
+  query2.option("--path <directory>", "Git worktree").option("--json", "emit response data, meta and guidance");
+  const run3 = async (value, opts) => {
+    const target = enterWorktree({ path: opts["path"] });
+    const params = {
+      ...operation === "search" || operation === "context" ? { q: value } : {},
+      ...operation === "explain" ? { symbol: value } : operation === "context" ? { symbol: opts["symbol"] } : {},
+      ...operation === "affected" ? { symbols: opts["symbol"], files: opts["file"], depth: opts["depth"], includeAmbiguous: opts["includeAmbiguous"], includeTypes: opts["includeTypes"] } : {},
+      kind: opts["kind"],
+      pathPrefix: opts["pathPrefix"],
+      limit: opts["limit"],
+      budgetTokens: opts["budgetTokens"]
+    };
+    validateQuery(operation, params);
+    await withConfig(opts["json"] === true, false, (ctx) => query(ctx, operation, params, target));
+  };
+  if (operation === "affected") query2.action(async (opts) => run3(void 0, opts));
+  else query2.action(run3);
+}
+var review = program.command("review").description("a pull request's enforced Review Council gate, and a retry of its latest attempt");
+review.command("status").description("the gate's enforced and advisory status, and a failed latest attempt with what comes next").argument("<pr>", "owner/repo#<pr>, the pull request URL, or <pr> with --repo or this checkout's origin").option("--repo <owner/repo>", "the repository a bare pull request number belongs to").option("--json", "emit JSON").action(async (pr, opts) => {
+  const ref = parsePullRequest(pr, opts.repo);
+  await withConfig(opts.json === true, false, (ctx) => status(ctx, ref));
+});
+review.command("retry").description(
+  "retry the latest gate attempt of the pull request's current head (needs reviews:write); the head, check and attempt are read from the gate status"
+).argument("<pr>", "owner/repo#<pr>, the pull request URL, or <pr> with --repo or this checkout's origin").option("--repo <owner/repo>", "the repository a bare pull request number belongs to").option("--reason <text>", "why the attempt is retried, recorded with it").option("--json", "emit JSON").action(async (pr, opts) => {
+  const ref = parsePullRequest(pr, opts.repo);
+  await withConfig(opts.json === true, true, (ctx) => retry(ctx, ref, opts.reason));
+});
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(
   "--timeout <ms>",
   "how long to wait for the browser callback",
-  integer
+  integer2
 ).option("--json", "emit JSON").action(
   async (opts) => {
     const repoLookup = findRepoConfig();
     for (const warning of repoLookup.warnings)
       writeStderr(warning + "\n");
     const repoUrl = repoLookup.config?.url;
-    const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? storedLoginUrl() ?? DEFAULT_BASE_URL;
+    const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? (repoLookup.config?.org === void 0 ? storedLoginUrl() : void 0) ?? DEFAULT_BASE_URL;
     if (url === repoUrl && opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0) {
       writeStderr(
         `harness: host ${url} comes from ${repoLookup.config?.path}
 `
       );
     }
+    const repoSelected = opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0 && repoUrl !== void 0;
+    if (repoSelected && !isHostTrusted(url)) {
+      if (!canConfirmRepoLogin()) {
+        writeStderr("harness: cannot confirm a repo-selected host without a terminal \u2014 pass --url explicitly\n");
+        return exitWith(2);
+      }
+      if (!await confirmRepoLogin(url, "repo-config", repoLookup.config?.path)) return exitWith(2);
+    }
     const options = { noBrowser: !opts.browser };
+    if (repoLookup.config?.org !== void 0) options.org = repoLookup.config.org;
     if (opts.timeout !== void 0) options.timeoutMs = opts.timeout;
     await finishAuth(await login(url, options), opts.json === true);
   }
 );
 program.command("logout").description("revoke and forget the stored login").option("--json", "emit JSON").action(async (opts) => {
-  await finishAuth(await logout(), opts.json === true);
+  const selected = resolveConfig({ ...process.env, HARNESS_API_TOKEN: void 0 });
+  if (selected.kind === "error") {
+    writeStderr(`harness: ${selected.message}
+`);
+    return exitWith(2);
+  }
+  const path = selected.kind === "ok" ? selected.config.credentialsPath : selected.credentialsPath;
+  await finishAuth(await logout(path === void 0 ? {} : { credentialsPath: path }), opts.json === true);
 });
 program.command("whoami").description("show the resolved host and credential source").option("--json", "emit JSON").action(async (opts) => {
   const resolved = resolveConfig();
@@ -2536,6 +3261,8 @@ program.command("whoami").description("show the resolved host and credential sou
   }
   if (resolved.kind === "needs-login") {
     writeStderr(loginHelp(resolved.baseUrl));
+    if (resolved.org !== void 0) writeStderr(`Choose organization ${resolved.org} when logging in.
+`);
     return exitWith(2);
   }
   const source = blankToUndefined(process.env["HARNESS_API_TOKEN"]) !== void 0 ? "environment" : "stored login";
@@ -2576,6 +3303,10 @@ try {
   if (notice !== null) writeStderr(notice);
 } catch {
 }
+if (invokedAs === "operator") {
+  const deprecation = operatorDeprecationNotice();
+  if (deprecation !== null) writeStderr(deprecation);
+}
 if (invokedAs === "operator") layoutOperatorHelp(program);
 if (argv.length <= 2) {
   program.outputHelp({ error: true });