@allocator-one/harness-cli 1.5.0 → 1.5.2

package/README.md

@@ -73,6 +73,33 @@ Auth resolution is identical to the CLI. Without a credential, tools return
 an error telling the agent to run `harness login` in a terminal — the
 server never opens a browser itself.
 
+### Text from a file, never from a shell argument
+
+Every free-text option has a `--<field>-file` companion, and `-` means stdin:
+
+```sh
+harness create --title "…" --description-file ./body.md
+harness update IO-123 --notes-file ./notes.md --acceptance-file ./ac.md
+harness comment IO-123 --body-file ./comment.md
+git log -1 --format=%B | harness close IO-123 --reason-file -
+```
+
+`create` and `update` cover `--title`, `--description`, `--design`, `--notes`
+and `--acceptance` (plus `--append-notes` on `update`); `close` takes
+`--reason-file`, `comment` takes `--body-file`.
+
+Use these whenever the text is not something you authored inline. Prose that
+reaches a shell argument has to survive quoting, and quoting can be defeated —
+a `"` closes the string, `$(…)` substitutes, and a heredoc ends at whatever
+flush-left delimiter line the text happens to contain. Handing over a path
+removes the question, the way `git commit -F` does. This matters most for
+agents relaying issue text they did not write.
+
+Passing both an inline value and its `-file` for the same field is a usage
+error rather than a silent precedence, and only one field per invocation may
+read stdin. Both are checked before anything is read, so a rejected command
+never consumes your pipe. One trailing newline is dropped, like `$(cat file)`.
+
 ## Repo config
 
 A committed `.harness-cli/config.json`, discovered git-style by walking up

package/dist/{chunk-FGBXAAKW.js → chunk-CIW4OU5G.js}

@@ -514,12 +514,19 @@ function pageCount(meta) {
 function dedupe(records) {
   const seen = /* @__PURE__ */ new Set();
   return records.filter((record) => {
-    const key = record["id"] ?? JSON.stringify(record);
+    const id = record["id"];
+    const key = id === void 0 || id === null ? `struct:${stableKey(record)}` : `id:${stableKey(id)}`;
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
   });
 }
+function stableKey(value) {
+  return JSON.stringify(
+    value,
+    (_field, nested) => nested !== null && typeof nested === "object" && !Array.isArray(nested) ? Object.fromEntries(Object.entries(nested).sort(([a], [b]) => a < b ? -1 : 1)) : nested
+  );
+}
 
 // src/commands/issues.ts
 var PRIORITY_NAMES = { urgent: 1, high: 2, medium: 3, low: 4, none: 0 };

package/dist/cli.js

@@ -70,7 +70,7 @@ import {
   version,
   workflowStates,
   writeCredentials
-} from "./chunk-FGBXAAKW.js";
+} from "./chunk-CIW4OU5G.js";
 
 // src/cli.ts
 import { createInterface as createInterface2 } from "readline";
@@ -383,6 +383,113 @@ function defaultOpenBrowser(url) {
   }
 }
 
+// src/core/textinput.ts
+import { readFileSync, statSync } from "fs";
+import { isatty } from "tty";
+var STDIN_PATH = "-";
+var MAX_TEXT_BYTES = 1e6;
+function flagOf(name) {
+  return name.replace(/[A-Z]/g, (upper) => `-${upper.toLowerCase()}`);
+}
+function resolveTextSources(sources) {
+  const resolved = {};
+  const toRead = [];
+  let stdinClaimedBy;
+  for (const { name, inline, file } of sources) {
+    if (inline !== void 0 && file !== void 0) {
+      throw new UsageError(
+        `--${flagOf(name)} and --${flagOf(name)}-file both given \u2014 pass one; there is no precedence between them`
+      );
+    }
+    if (file === void 0) {
+      if (inline !== void 0) resolved[name] = inline;
+      continue;
+    }
+    if (file === STDIN_PATH) {
+      if (isatty(0)) {
+        throw new UsageError(
+          `--${flagOf(name)}-file - reads stdin, but stdin is a terminal \u2014 pipe something in or pass a path`
+        );
+      }
+      if (stdinClaimedBy !== void 0) {
+        throw new UsageError(
+          `--${flagOf(name)}-file and --${flagOf(stdinClaimedBy)}-file both read stdin \u2014 there is only one stream, so only one may be "-"`
+        );
+      }
+      stdinClaimedBy = name;
+    }
+    if (file !== STDIN_PATH) checkReadable(file, name);
+    toRead.push({ name, file });
+  }
+  for (const { name, file } of [...toRead].sort(byStdinLast)) {
+    resolved[name] = stripOneTrailingNewline(readTextFile(file, name));
+  }
+  return resolved;
+}
+function readTextFile(path, name) {
+  if (path === STDIN_PATH) {
+    let piped;
+    try {
+      piped = readFileSync(0);
+    } catch (error) {
+      throw new UsageError(`--${flagOf(name)}-file -: cannot read stdin (${describe(error)})`);
+    }
+    if (piped.length > MAX_TEXT_BYTES) {
+      throw new UsageError(oversize(`--${flagOf(name)}-file -`));
+    }
+    return decodeUtf8(piped, `--${flagOf(name)}-file -`);
+  }
+  const flag = `--${flagOf(name)}-file ${path}`;
+  let bytes;
+  try {
+    bytes = readFileSync(path);
+  } catch (error) {
+    throw new UsageError(`${flag}: ${describe(error)}`);
+  }
+  if (bytes.length > MAX_TEXT_BYTES) throw new UsageError(oversize(flag));
+  return decodeUtf8(bytes, flag);
+}
+function decodeUtf8(bytes, flag) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new UsageError(`${flag}: not valid UTF-8 \u2014 convert it first`);
+  }
+}
+function oversize(what) {
+  return `${what}: over ${MAX_TEXT_BYTES / 1e6} MB \u2014 that is not prose; check the path`;
+}
+function checkReadable(path, name) {
+  const flag = `--${flagOf(name)}-file ${path}`;
+  let stats2;
+  try {
+    stats2 = statSync(path);
+  } catch (error) {
+    throw new UsageError(`${flag}: ${describe(error)}`);
+  }
+  if (!stats2.isFile()) {
+    throw new UsageError(
+      `${flag}: ${stats2.isDirectory() ? "is a directory" : "not a regular file"}`
+    );
+  }
+  if (stats2.size > MAX_TEXT_BYTES) throw new UsageError(oversize(flag));
+}
+function byStdinLast(a, b) {
+  return Number(a.file === STDIN_PATH) - Number(b.file === STDIN_PATH);
+}
+function stripOneTrailingNewline(text) {
+  if (text.endsWith("\r\n")) return text.slice(0, -2);
+  if (text.endsWith("\n")) return text.slice(0, -1);
+  return text;
+}
+function describe(error) {
+  const code = error?.code;
+  if (code === "ENOENT") return "no such file";
+  if (code === "EISDIR") return "is a directory";
+  if (code === "EACCES") return "permission denied";
+  return error instanceof Error ? error.message : String(error);
+}
+
 // src/core/stdio.ts
 var BROKEN_PIPE_CODES = /* @__PURE__ */ new Set(["EPIPE", "ERR_STREAM_DESTROYED"]);
 function guardBrokenPipes(streams = [process.stdout, process.stderr]) {
@@ -401,11 +508,11 @@ import {
   existsSync,
   linkSync,
   mkdirSync,
-  readFileSync,
+  readFileSync as readFileSync2,
   realpathSync,
   renameSync,
   rmSync,
-  statSync,
+  statSync as statSync2,
   writeFileSync
 } from "fs";
 import { basename, dirname, join as join2, parse, sep } from "path";
@@ -448,7 +555,7 @@ function findPackageRoot(from) {
 }
 function packageNameAt(path) {
   try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
     if (typeof parsed !== "object" || parsed === null) return null;
     const name = parsed["name"];
     return typeof name === "string" ? name : null;
@@ -459,7 +566,7 @@ function packageNameAt(path) {
 function versionAt(packageRoot) {
   try {
     const parsed = JSON.parse(
-      readFileSync(join2(packageRoot, "package.json"), "utf8")
+      readFileSync2(join2(packageRoot, "package.json"), "utf8")
     );
     if (typeof parsed !== "object" || parsed === null) return null;
     const version2 = parsed["version"];
@@ -524,7 +631,7 @@ function stampPath(env = process.env) {
 }
 function readStamp(env = process.env) {
   try {
-    const parsed = JSON.parse(readFileSync(stampPath(env), "utf8"));
+    const parsed = JSON.parse(readFileSync2(stampPath(env), "utf8"));
     if (typeof parsed !== "object" || parsed === null) return null;
     const record = parsed;
     const checkedAt = record["checkedAt"];
@@ -829,8 +936,8 @@ function releaseLock(lock) {
 }
 function readHolder(path) {
   try {
-    const mtimeMs = statSync(path).mtimeMs;
-    const pid = Number.parseInt(readFileSync(path, "utf8").trim(), 10);
+    const mtimeMs = statSync2(path).mtimeMs;
+    const pid = Number.parseInt(readFileSync2(path, "utf8").trim(), 10);
     return { pid: Number.isInteger(pid) && pid > 0 ? pid : null, mtimeMs };
   } catch {
     return null;
@@ -1081,17 +1188,43 @@ program.command("version").description("print CLI and server API versions").opti
   );
   await exitWith(0);
 });
-program.command("create").description("create an issue").option("--title <text>", "issue title (required)").option("--description <text>", "problem statement").option("--design <text>", "design notes").option("--notes <text>", "working notes").option("--acceptance <text>", "acceptance criteria").option(
+function issueTextSources(opts) {
+  return [
+    { name: "title", inline: opts.title, file: opts.titleFile },
+    { name: "description", inline: opts.description, file: opts.descriptionFile },
+    { name: "design", inline: opts.design, file: opts.designFile },
+    { name: "notes", inline: opts.notes, file: opts.notesFile },
+    { name: "acceptance", inline: opts.acceptance, file: opts.acceptanceFile }
+  ];
+}
+function requireNonBlankInlineTitle(title) {
+  if (title !== void 0 && title.trim() === "") {
+    throw new UsageError("--title is empty \u2014 an issue needs a title");
+  }
+}
+function requireNonBlankTitle(text, titleFile) {
+  if ((text["title"] ?? "").trim() !== "") return;
+  throw new UsageError(
+    titleFile === void 0 ? "--title is empty \u2014 an issue needs a title" : `--title-file ${titleFile} produced an empty title`
+  );
+}
+program.command("create").description("create an issue").option("--title <text>", "issue title (required)").option("--description <text>", "problem statement").option("--design <text>", "design notes").option("--notes <text>", "working notes").option("--acceptance <text>", "acceptance criteria").option("--title-file <path>", 'read the title from a file ("-" for stdin)').option("--description-file <path>", 'read the description from a file ("-" for stdin)').option("--design-file <path>", 'read the design notes from a file ("-" for stdin)').option("--notes-file <path>", 'read the notes from a file ("-" for stdin)').option("--acceptance-file <path>", 'read the acceptance criteria from a file ("-" for stdin)').option(
   "--type <type>",
   "task | bug | feature | epic (applied as a type/ label)"
 ).option("--priority <name>", "urgent | high | medium | low | none").option("--due-date <date>", "YYYY-MM-DD").option("--parent <id>", "parent epic").option("--assignee <who>", "me, a user id, an email, or a full name").option("--team <key>", "team key (or HARNESS_TEAM)").option("--label <name>", "label to apply (repeatable)", collect, []).option("--json", "emit JSON").action(async (opts) => {
-  await withConfig(
-    opts.json === true,
-    true,
-    (ctx) => create(ctx, opts)
-  );
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (opts.title === void 0 && opts.titleFile === void 0) {
+      throw new UsageError(
+        "usage: harness create --title <title> | --title-file <path> [--team <key>] \u2026"
+      );
+    }
+    requireNonBlankInlineTitle(opts.title);
+    const text = resolveTextSources(issueTextSources(opts));
+    requireNonBlankTitle(text, opts.titleFile);
+    return create(ctx, { ...opts, ...text });
+  });
 });
-program.command("update").description("update an issue; --claim takes it atomically").argument("[id]").option("--claim", "claim atomically and move to the first started state").option("--state <name>", "workflow state by name or type").option("--title <text>").option("--description <text>").option("--design <text>").option("--notes <text>", "replace the notes").option("--append-notes <text>", "append to the notes").option("--acceptance <text>").option("--priority <name>", "urgent | high | medium | low | none").option("--due-date <date>", 'YYYY-MM-DD; "" clears').option("--parent <id>").option(
+program.command("update").description("update an issue; --claim takes it atomically").argument("[id]").option("--claim", "claim atomically and move to the first started state").option("--state <name>", "workflow state by name or type").option("--title <text>").option("--description <text>").option("--design <text>").option("--notes <text>", "replace the notes").option("--append-notes <text>", "append to the notes").option("--acceptance <text>").option("--title-file <path>", 'read the title from a file ("-" for stdin)').option("--description-file <path>", 'read the description from a file ("-" for stdin)').option("--design-file <path>", 'read the design notes from a file ("-" for stdin)').option("--notes-file <path>", 'replace the notes from a file ("-" for stdin)').option("--append-notes-file <path>", 'append to the notes from a file ("-" for stdin)').option("--acceptance-file <path>", 'read the acceptance criteria from a file ("-" for stdin)').option("--priority <name>", "urgent | high | medium | low | none").option("--due-date <date>", 'YYYY-MM-DD; "" clears').option("--parent <id>").option(
   "--assignee <who>",
   'me, a user id, an email, or a full name; "" unassigns'
 ).option("--json", "emit JSON").action(
@@ -1103,20 +1236,34 @@ program.command("update").description("update an issue; --claim takes it atomica
         );
       }
       requireIdentifiers2([id]);
-      return update(ctx, id, opts);
+      requireNonBlankInlineTitle(opts.title);
+      const text = resolveTextSources([
+        ...issueTextSources(opts),
+        { name: "appendNotes", inline: opts.appendNotes, file: opts.appendNotesFile }
+      ]);
+      if (Object.hasOwn(text, "title")) requireNonBlankTitle(text, opts.titleFile);
+      return update(ctx, id, { ...opts, ...text });
     });
   }
 );
-program.command("close").description("close issues; the response lists newly unblocked issues").argument("[ids...]").option("--reason <text>", "why it is done (e.g. the commit hash)").option("--cancel", "close as canceled instead of completed").option("--json", "emit JSON").action(
+program.command("close").description("close issues; the response lists newly unblocked issues").argument("[ids...]").option("--reason <text>", "why it is done (e.g. the commit hash)").option("--reason-file <path>", 'read the reason from a file ("-" for stdin)').option("--cancel", "close as canceled instead of completed").option("--json", "emit JSON").action(
   async (ids, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
       if (ids.length === 0) {
         throw new UsageError(
-          "usage: harness close <id> [<id>\u2026] [--reason <text>] [--cancel]"
+          "usage: harness close <id> [<id>\u2026] [--reason <text> | --reason-file <path>] [--cancel]"
         );
       }
       requireIdentifiers2(ids);
-      return close(ctx, ids, opts);
+      const text = resolveTextSources([
+        { name: "reason", inline: opts.reason, file: opts.reasonFile }
+      ]);
+      if (Object.hasOwn(text, "reason") && (text["reason"] ?? "").trim() === "") {
+        throw new UsageError(
+          opts.reasonFile === void 0 ? "--reason is empty \u2014 omit it, or give a reason" : `--reason-file ${opts.reasonFile} produced an empty reason`
+        );
+      }
+      return close(ctx, ids, { ...opts, ...text });
     });
   }
 );
@@ -1151,17 +1298,31 @@ program.command("dep").description("blocking dependencies: dep add|rm <issue> <b
     });
   }
 );
-program.command("comment").description("comment on an issue").argument("[id]").argument("[text...]").option("--mention <name>", "notify a person (repeatable)", collect, []).option("--json", "emit JSON").action(
+program.command("comment").description("comment on an issue").argument("[id]").argument("[text...]").option("--body-file <path>", 'read the comment body from a file ("-" for stdin)').option("--mention <name>", "notify a person (repeatable)", collect, []).option("--json", "emit JSON").action(
   async (id, text, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
-      if (id === void 0 || text.length === 0) {
+      if (id === void 0 || opts.bodyFile === void 0 && text.length === 0) {
         throw new UsageError(
-          "usage: harness comment <id> <text> [--mention NAME]\u2026"
+          "usage: harness comment <id> <text> [--mention NAME]\u2026 | harness comment <id> --body-file <path>"
         );
       }
       requireIdentifiers2([id]);
+      if (opts.bodyFile !== void 0 && text.length > 0) {
+        throw new UsageError(
+          "comment text and --body-file both given \u2014 pass one; there is no precedence between them"
+        );
+      }
+      const fromFile = resolveTextSources([
+        { name: "body", inline: void 0, file: opts.bodyFile }
+      ]).body;
+      const body = fromFile === void 0 ? text : [fromFile];
+      if (body.join(" ").trim() === "") {
+        throw new UsageError(
+          opts.bodyFile === void 0 ? "the comment text is empty \u2014 nothing to post" : `--body-file ${opts.bodyFile} produced an empty comment \u2014 nothing to post`
+        );
+      }
       const mentions = opts.mention.filter((name) => name.trim() !== "");
-      return comment(ctx, id, text, mentions);
+      return comment(ctx, id, body, mentions);
     });
   }
 );
@@ -1391,7 +1552,7 @@ program.command("upload").description("upload a file; prints markdown to referen
   });
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-ZRD4RTFU.js");
+  const { startMcpServer } = await import("./server-J2V5JXFY.js");
   await startMcpServer();
 });
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(

package/dist/{server-ZRD4RTFU.js → server-J2V5JXFY.js}

@@ -50,7 +50,7 @@ import {
   upload,
   userList,
   workflowStates
-} from "./chunk-FGBXAAKW.js";
+} from "./chunk-CIW4OU5G.js";
 
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allocator-one/harness-cli",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "CLI and MCP server for Harness, allocator.one's issue tracker",
   "type": "module",
   "license": "MIT",