@allocator-one/infraone 0.0.0-stage → 1.17.0

package/dist/cli.js

@@ -0,0 +1,3329 @@
+#!/usr/bin/env node
+import {
+  UPDATE_CHECK_COMMAND,
+  guardBrokenPipes,
+  operatorDeprecationNotice,
+  performUpdateCheck,
+  selfHeal,
+  updateCheck
+} from "./chunk-A4WZAC7L.js";
+import {
+  ACTIVITY_MAX_LIMIT,
+  EXIT_INTERRUPTED,
+  EXIT_JOB_ENDED,
+  EXIT_WAITING_FOR_PERSON,
+  JOBS_MAX_LIMIT,
+  JOBS_MAX_PAGES,
+  JOB_STATES,
+  PLAN_LIST_MAX_LIMIT,
+  PLAN_STATUSES,
+  RELATION_CREATE_TYPES,
+  RELATION_UPDATE_TYPES,
+  STEER_MAX_CHARACTERS,
+  activity,
+  archive,
+  assignments,
+  attachImage,
+  blocked,
+  close,
+  comment,
+  comments,
+  conditionList,
+  create,
+  deleteComment,
+  dep,
+  docCreate,
+  docList,
+  docShow,
+  docUpdate,
+  editComment,
+  gateSet,
+  instructionFrom,
+  jobCancel,
+  jobContinue,
+  jobPause,
+  jobShow,
+  jobSteer,
+  jobWatch,
+  jobsList,
+  labelCreate,
+  labelDelete,
+  labelList,
+  labelUpdate,
+  linkAdd,
+  linkList,
+  linkRm,
+  linkUpdate,
+  list,
+  memberAdd,
+  memberList,
+  memberSetRole,
+  milestoneCreate,
+  milestoneList,
+  planCreate,
+  planEdit,
+  planHold,
+  planList,
+  planRelease,
+  planShow,
+  prepareProcedureRun,
+  prepareRun,
+  prime,
+  procedureSave,
+  procedureShow,
+  projectCreate,
+  projectList,
+  projectShow,
+  projectUpdate,
+  readPlanFile,
+  ready,
+  relationAdd,
+  relationList,
+  relationRm,
+  relationUpdate,
+  requireCapabilityId,
+  requireCloseArgs,
+  requireCommentId,
+  requireIdentifiers,
+  requireJobId,
+  requireJobsArgs,
+  requirePlanListArgs,
+  requirePlanRef,
+  requireProcedureId,
+  requireProcedureName,
+  requireReadyClaimArgs,
+  requireSchemaView,
+  requireSearchQuery,
+  requireToolsOpts,
+  requiredTeam,
+  resolveTextSources,
+  run,
+  search,
+  show,
+  skillsList,
+  startProcedureRun,
+  stateAdd,
+  stateDelete,
+  stateOrder,
+  stateUpdate,
+  stats,
+  teamCreate,
+  teamList,
+  teamRename,
+  teamSetDefault,
+  toolShow,
+  toolsDomains,
+  toolsList,
+  toolsSearch,
+  update,
+  upload,
+  userList,
+  validateIdempotencyKey,
+  version,
+  watchStopSignal,
+  workflowStates
+} from "./chunk-CEEQW6ZV.js";
+import {
+  login,
+  logout,
+  whoami
+} from "./chunk-WSDFLMO6.js";
+import {
+  Client,
+  CommandError,
+  DEFAULT_BASE_URL,
+  HttpError,
+  LocalError,
+  TransportError,
+  UpgradeRequiredError,
+  UsageError,
+  clean,
+  defaultCredentialsPath,
+  errorDetails,
+  explainExpertRefusal,
+  findRepoConfig,
+  isHostTrusted,
+  json,
+  loginHelp,
+  readCredentials,
+  resolveCacheHome,
+  resolveConfig,
+  trustHost
+} from "./chunk-BHBEIT5I.js";
+import {
+  CLI_VERSION,
+  invokedName,
+  layoutOperatorHelp,
+  named
+} from "./chunk-5THYIKLW.js";
+
+// src/cli.ts
+import { createInterface } from "readline";
+import { Command, CommanderError, InvalidArgumentError } from "commander";
+
+// src/commands/keys.ts
+import { spawn } from "child_process";
+import { constants } from "os";
+var KEY_ENV_VARS = /* @__PURE__ */ new Map([
+  ["anthropic", "ANTHROPIC_API_KEY"],
+  ["openai", "OPENAI_API_KEY"],
+  ["google", "GEMINI_API_KEY"],
+  ["openrouter", "OPENROUTER_API_KEY"],
+  ["brave", "BRAVE_API_KEY"],
+  ["perplexity", "PERPLEXITY_API_KEY"]
+]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function fetchKeys(ctx) {
+  let body;
+  try {
+    body = await ctx.client.get("/api/v1/model-keys");
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 403 && error.message.includes("model-keys:read")) {
+      throw new CommandError(
+        `${error.message} \u2014 login tokens carry model-keys:read; aone_ API tokens must be minted with it`
+      );
+    }
+    throw error;
+  }
+  const data = isRecord(body) ? body["data"] : void 0;
+  const keys2 = isRecord(data) ? data["keys"] : void 0;
+  if (!isRecord(keys2)) throw new CommandError("unexpected model-keys response: no keys map");
+  const stored = /* @__PURE__ */ new Map();
+  for (const [slug, value] of Object.entries(keys2)) {
+    const canonical = slug.trim().toLowerCase();
+    if (stored.has(canonical)) continue;
+    if (typeof value === "string" && value.trim() !== "" && !value.includes("\0")) stored.set(canonical, value);
+  }
+  return stored;
+}
+function envVarFor(slug) {
+  return KEY_ENV_VARS.get(slug.trim().toLowerCase());
+}
+function normalizeSlugs(only) {
+  return [...new Set(only.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""))];
+}
+function selectSlugs(stored, only) {
+  if (only === void 0 || only.length === 0) return new Map(stored);
+  const wanted = new Set(only.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""));
+  return new Map([...stored].filter(([slug]) => wanted.has(slug)));
+}
+function unknownSlugs(only) {
+  return only.map((slug) => slug.trim()).filter((slug) => slug !== "" && !KEY_ENV_VARS.has(slug.toLowerCase()));
+}
+function withholdOthers(base2, requested) {
+  const keep = new Set(requested.map((slug) => envVarFor(slug)));
+  const env = { ...base2 };
+  for (const name of KEY_ENV_VARS.values()) {
+    if (!keep.has(name)) delete env[name];
+  }
+  return env;
+}
+function unstoredSlugs(requested, stored) {
+  const canonical = [...new Set(requested.map((slug) => slug.trim().toLowerCase()).filter((slug) => slug !== ""))];
+  return canonical.filter((slug) => !stored.has(slug));
+}
+function toEnv(stored) {
+  const env = {};
+  for (const [slug, value] of stored) {
+    const name = envVarFor(slug);
+    if (name !== void 0) env[name] = value;
+  }
+  return env;
+}
+function childEnv(base2, fetched, override) {
+  const env = {};
+  for (const [name, value] of Object.entries(base2)) {
+    if (value !== void 0) env[name] = value;
+  }
+  for (const [name, value] of Object.entries(fetched)) {
+    const existing = env[name];
+    if (override || existing === void 0 || existing.trim() === "") env[name] = value;
+  }
+  return env;
+}
+function exitCodeFor(code2, signal) {
+  if (code2 !== null) return code2;
+  if (signal !== null) {
+    const number = constants.signals[signal];
+    if (typeof number === "number") return 128 + number;
+  }
+  return 1;
+}
+async function list2(ctx) {
+  const stored = await fetchKeys(ctx);
+  const providers = [...stored.keys()].sort().map((provider) => ({ provider, env: envVarFor(provider) ?? null }));
+  const human = providers.map(({ provider, env }) => `${clean(provider)}	${env ?? "(no env var)"}
+`).join("");
+  return { json: { providers }, human };
+}
+var FORWARDED_SIGNALS = ["SIGTERM"];
+var HELD_SIGNALS = ["SIGINT"];
+async function exec(ctx, opts) {
+  const [program2, ...args] = opts.command;
+  if (program2 === void 0 || program2 === "") {
+    throw new UsageError("keys exec: name the command to run after `--`, e.g. `harness keys exec -- npm test`");
+  }
+  if (process.platform === "win32") {
+    throw new LocalError("keys exec is available on macOS and Linux only");
+  }
+  const onlyGiven = opts.only !== void 0 && opts.only.length > 0;
+  if (onlyGiven && normalizeSlugs(opts.only ?? []).length === 0) {
+    throw new UsageError(`keys exec: --only needs at least one provider slug \u2014 known: ${[...KEY_ENV_VARS.keys()].join(", ")}`);
+  }
+  const unknown = unknownSlugs(opts.only ?? []);
+  if (unknown.length > 0) {
+    throw new UsageError(
+      `keys exec: unknown provider slug ${unknown.map(clean).join(", ")} \u2014 known: ${[...KEY_ENV_VARS.keys()].join(", ")}`
+    );
+  }
+  const stored = await fetchKeys(ctx);
+  const requested = normalizeSlugs(opts.only ?? []);
+  const narrowed = requested.length > 0;
+  if (narrowed) {
+    const missing = unstoredSlugs(requested, stored);
+    if (missing.length > 0) {
+      process.stderr.write(
+        named(
+          `harness: no key stored for ${missing.join(", ")} \u2014 the command gets your shell's own variable for those, if any
+`
+        )
+      );
+    }
+  }
+  const env = childEnv(
+    narrowed ? withholdOthers(process.env, requested) : process.env,
+    toEnv(selectSlugs(stored, requested)),
+    opts.override
+  );
+  const name = clean(program2);
+  const exitCode = await new Promise((resolve3, reject) => {
+    let child;
+    try {
+      child = spawn(program2, args, { stdio: "inherit", env });
+    } catch (error) {
+      const code2 = error.code ?? "invalid arguments";
+      reject(new CommandError(`cannot start ${name}: ${code2}`));
+      return;
+    }
+    const handlers = [];
+    for (const signal of FORWARDED_SIGNALS) {
+      const handler = () => {
+        child.kill(signal);
+      };
+      process.on(signal, handler);
+      handlers.push([signal, handler]);
+    }
+    for (const signal of HELD_SIGNALS) {
+      const handler = () => {
+      };
+      process.on(signal, handler);
+      handlers.push([signal, handler]);
+    }
+    let settled = false;
+    let spawned = false;
+    const settle = (outcome) => {
+      if (settled) return;
+      settled = true;
+      for (const [signal, handler] of handlers) process.off(signal, handler);
+      outcome();
+    };
+    child.once("spawn", () => {
+      spawned = true;
+    });
+    child.on("error", (error) => {
+      settle(() => {
+        const code2 = error.code ?? error.message;
+        reject(new CommandError(spawned ? `${name} failed: ${code2}` : `cannot run ${name}: ${code2}`));
+      });
+    });
+    child.on("exit", (code2, signal) => {
+      settle(() => resolve3(exitCodeFor(code2, signal)));
+    });
+  });
+  return { json: { exit_code: exitCode }, human: "", exitCode };
+}
+
+// src/commands/review.ts
+import { execFileSync } from "child_process";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var SLUG = /^([\w.-]+)\/([\w.-]+)$/;
+function githubSlug(remote) {
+  const match = /^(?:(?:https?|ssh|git):\/\/(?:[^@/\s]+@)?|[\w.-]+@)github\.com[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/i.exec(remote.trim());
+  return match ? `${match[1]}/${match[2]}` : void 0;
+}
+function originRemote() {
+  try {
+    const url = execFileSync("git", ["remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return githubSlug(url);
+  } catch {
+    return void 0;
+  }
+}
+function prNumber(digits, input) {
+  const number = Number(digits);
+  if (!Number.isSafeInteger(number) || number < 1) throw new UsageError(`not a pull request number: ${input}`);
+  return number;
+}
+var NAME = /^[\w.-]+$/;
+function fromUrl(input) {
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    return null;
+  }
+  if (!["https:", "http:"].includes(url.protocol) || !/^(www\.)?github\.com$/i.test(url.hostname)) return null;
+  let segments;
+  try {
+    segments = url.pathname.split("/").filter((segment) => segment !== "").map(decodeURIComponent);
+  } catch {
+    return null;
+  }
+  const [owner, repo, kind, number] = segments;
+  if (kind !== "pull" || !owner || !repo || !number || !NAME.test(owner) || !NAME.test(repo) || !/^\d+$/.test(number)) {
+    return null;
+  }
+  return [owner, repo, number];
+}
+function parsePullRequest(input, repo, origin = originRemote) {
+  const trimmed = input.trim();
+  const url = fromUrl(trimmed);
+  if (url) return { owner: url[0], repo: url[1], number: prNumber(url[2], input) };
+  const named2 = /^([\w.-]+)\/([\w.-]+)#(\d+)$/.exec(trimmed);
+  if (named2) return { owner: named2[1], repo: named2[2], number: prNumber(named2[3], input) };
+  const bare = /^#?(\d+)$/.exec(trimmed);
+  if (!bare) throw new UsageError(`not a pull request: ${input} \u2014 use owner/repo#<pr>, its URL, or <pr> with --repo`);
+  const slug = repo ?? origin();
+  const parts = slug === void 0 ? null : SLUG.exec(slug.trim());
+  if (!parts) throw new UsageError("name the repository: owner/repo#<pr>, the pull request URL, or --repo owner/repo");
+  return { owner: parts[1], repo: parts[2], number: prNumber(bare[1], input) };
+}
+var label = (pr) => `${pr.owner}/${pr.repo}#${pr.number}`;
+var gatePath = (pr) => `/api/v1/reviews/prs/${encodeURIComponent(pr.owner)}/${encodeURIComponent(pr.repo)}/${pr.number}`;
+async function fetchGate(ctx, pr) {
+  const body = await ctx.client.get(gatePath(pr));
+  if (!isRecord2(body.data)) throw new CommandError(`unexpected gate status for ${label(pr)}: no data`);
+  return body.data;
+}
+function latestAttempt(lifecycle) {
+  const attempts = Array.isArray(lifecycle["attempts"]) ? lifecycle["attempts"].filter(isRecord2) : [];
+  return attempts.reduce(
+    (latest, attempt) => latest === void 0 || Number(attempt["number"]) > Number(latest["number"]) ? attempt : latest,
+    void 0
+  );
+}
+function recovery(lifecycle) {
+  const latest = latestAttempt(lifecycle);
+  const sent = isRecord2(lifecycle["recovery"]) ? lifecycle["recovery"] : void 0;
+  const state2 = String(sent?.["state"] ?? latest?.["state"] ?? "");
+  if (state2 !== "failed" && state2 !== "timed_out") return void 0;
+  const reason = sent?.["terminal_reason"] ?? latest?.["terminal_reason"];
+  return {
+    number: latest?.["number"],
+    state: state2 === "timed_out" ? "timed out" : state2,
+    reason: typeof reason === "string" ? reason : null,
+    evidence: sent ? sent["evidence_recorded"] === true : latest?.["review_run_id"] != null,
+    next: sent?.["next"] === "automatic_retry" ? "automatic_retry" : "retry"
+  };
+}
+function describe(r) {
+  const why = [r.reason, r.evidence ? null : "no evidence recorded"].filter((part) => part !== null).join(", ");
+  return `attempt ${clean(String(r.number))} ${r.state}${why === "" ? "" : ` (${clean(why)})`}`;
+}
+function projection(gate2, key) {
+  const value = gate2[key];
+  return isRecord2(value) && typeof value["status"] === "string" ? clean(value["status"]) : "unknown";
+}
+async function status(ctx, pr) {
+  const gate2 = await fetchGate(ctx, pr);
+  const lifecycle = isRecord2(gate2["lifecycle"]) ? gate2["lifecycle"] : void 0;
+  const head = isRecord2(gate2["head"]) && typeof gate2["head"]["sha"] === "string" ? gate2["head"]["sha"].slice(0, 10) : "?";
+  const lines = [
+    `${label(pr)} at ${clean(head)}`,
+    `enforced: ${projection(gate2, "enforced")}   advisory: ${projection(gate2, "advisory")}`
+  ];
+  if (lifecycle) {
+    lines.push(`gate check: ${clean(String(lifecycle["state"] ?? "unknown")).replaceAll("_", " ")}`);
+    const r = recovery(lifecycle);
+    if (r) {
+      lines.push(`latest ${describe(r)}`);
+      lines.push(
+        r.next === "automatic_retry" ? "Harness retries it automatically; check again shortly." : named(`Retry it with: harness review retry ${label(pr)} --reason "\u2026"`)
+      );
+    }
+  }
+  return { json: gate2, human: lines.join("\n") + "\n" };
+}
+var REFUSALS = {
+  execution_not_terminal: "the latest attempt is still running; wait for it to finish",
+  attempt_changed: "another attempt was created meanwhile; read the status and run this again",
+  check_changed: "the head's gate check changed meanwhile; run this again",
+  head_changed: "the pull request's head moved; the new head gets its own check",
+  advisory_not_converged: "the head's advisory review has not converged; converge it first",
+  retry_conflict: "this attempt was already retried with a different reason",
+  merged: "the pull request is merged"
+};
+async function retry(ctx, pr, reason) {
+  const gate2 = await fetchGate(ctx, pr);
+  const lifecycle = isRecord2(gate2["lifecycle"]) ? gate2["lifecycle"] : void 0;
+  if (!lifecycle || typeof lifecycle["check_id"] !== "string" || typeof lifecycle["head_sha"] !== "string") {
+    throw new CommandError(`${label(pr)} has no gate check at its current head: nothing to retry`);
+  }
+  const r = recovery(lifecycle);
+  if (r?.next === "automatic_retry") {
+    throw new CommandError(named(`Harness retries attempt ${clean(String(r.number))} itself; run harness review status ${label(pr)} shortly`));
+  }
+  const previous = latestAttempt(lifecycle);
+  const previousId = typeof previous?.["id"] === "string" ? previous["id"] : null;
+  const body = {
+    head_sha: lifecycle["head_sha"],
+    check_id: lifecycle["check_id"],
+    previous_attempt_id: previousId,
+    // One key per attempt retried: running this again for the same attempt returns the attempt already
+    // queued instead of paying for another review run.
+    request_key: `harness-cli:${previousId ?? lifecycle["check_id"]}`,
+    reason: reason?.trim() || "Retry requested with harness review retry"
+  };
+  let response;
+  try {
+    response = await ctx.client.post(`${gatePath(pr)}/retry`, body, { actor: false });
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 409) {
+      const code2 = error.message.trim().split(/[\s:]+/).pop() ?? "";
+      throw new CommandError(`could not retry ${label(pr)}: ${REFUSALS[code2] ?? clean(error.message)}`);
+    }
+    if (error instanceof HttpError && error.status === 403) {
+      throw new CommandError(`${error.message} \u2014 a retry needs a login with reviews:write`);
+    }
+    throw error;
+  }
+  const attempt = isRecord2(response.data) ? response.data : {};
+  const outcome = response["outcome"];
+  const verb = outcome === "existing" ? "Already queued" : "Queued";
+  return {
+    json: { attempt, outcome },
+    human: `${verb} attempt ${clean(String(attempt["number"]))} (${clean(String(attempt["id"]))}) for ${label(pr)}
+`
+  };
+}
+
+// src/commands/code/index.ts
+import { resolve as resolve2 } from "path";
+import { statSync } from "fs";
+
+// src/core/code/http.ts
+import { setTimeout as delay } from "timers/promises";
+import { z } from "zod";
+var UUID = z.string().uuid();
+var HASH = z.string().regex(/^[a-f0-9]{64}$/);
+var view = z.object({
+  view_id: UUID,
+  view_key: z.string(),
+  repository_id: UUID,
+  active: z.object({
+    version: z.number().int(),
+    base_commit: z.string(),
+    overlay_digest: HASH,
+    indexed_at: z.string().nullable().optional()
+  }).nullable(),
+  pending: z.object({
+    version: z.number().int(),
+    state: z.string(),
+    progress: z.object({ done: z.number().int().nonnegative(), total: z.number().int().nonnegative() }).nullable().optional(),
+    error: z.unknown().optional()
+  }).nullable()
+});
+var policy = z.object({
+  org_id: UUID,
+  policy_digest: z.string().min(1).max(256),
+  max_file_bytes: z.number().int().positive(),
+  max_batch_bytes: z.number().int().positive(),
+  include_extensions: z.array(z.string().max(32)).max(100),
+  deny_globs: z.array(z.string().max(1024)).max(1e3),
+  deny_glob_case: z.literal("ascii_insensitive").optional(),
+  content_patterns: z.array(z.string().max(4096)).max(100),
+  org_name: z.string().optional()
+});
+var base = z.object({
+  state: z.enum(["fetching", "complete", "ready", "failed"]),
+  policy_digest: z.string().optional(),
+  file_count: z.number().optional(),
+  excluded_count: z.number().optional(),
+  skipped: z.array(z.object({ path: z.string(), reason: z.string() })).optional(),
+  error: z.unknown().optional(),
+  retry_after_ms: z.number().nonnegative().optional()
+});
+var opened = z.object({
+  sync_id: UUID,
+  state: z.string(),
+  missing: z.array(HASH),
+  rejected: z.array(z.object({ path: z.string(), error: z.string() }))
+});
+var activated = z.object({
+  pending_version: z.number().int().positive(),
+  state: z.string()
+});
+var syncStatus = z.object({
+  id: UUID,
+  state: z.enum(["receiving", "queued", "indexing", "active", "superseded", "failed"]),
+  version: z.number().int().nonnegative().nullable()
+});
+function decode(schema, data) {
+  const result = schema.safeParse(data);
+  if (!result.success)
+    throw new CommandError(
+      "The code index API returned an invalid response; no additional source will be uploaded."
+    );
+  return result.data;
+}
+function retryAfterMs(value, now = Date.now()) {
+  if (value === null) return void 0;
+  const seconds = Number(value);
+  if (/^\d+(?:\.\d+)?$/.test(value) && Number.isFinite(seconds))
+    return seconds * 1e3;
+  const date = Date.parse(value);
+  return Number.isNaN(date) ? void 0 : Math.max(0, date - now);
+}
+function describeCodeError(error) {
+  const code2 = error.body["error"];
+  let message = error.message;
+  if (code2 === "repository_not_connected")
+    message = "repository_not_connected: share this repository through your organization\u2019s Harness GitHub connection before syncing.";
+  if (code2 === "code_index_disabled")
+    message = "code_index_disabled: code indexing is disabled for this organization; ask a Harness administrator to enable it.";
+  if (code2 === "quota_exceeded") {
+    const raw = error.body["details"];
+    const d = raw && typeof raw === "object" ? raw : {};
+    message = `quota_exceeded: your organization\u2019s code index limit ${typeof d["quota"] === "string" ? d["quota"] : "quota"} is reached (limit ${typeof d["limit"] === "number" ? d["limit"] : "unknown"}). Ask a Harness administrator.`;
+  }
+  if (code2 === "invalid_sync")
+    message = "invalid_sync: the client sync request does not match the server contract. Upgrade the client and retry code sync.";
+  if (code2 === "overlay_too_large") {
+    const raw = error.body["details"];
+    const details = raw && typeof raw === "object" ? raw : {};
+    const limit = typeof details["limit"] === "number" ? details["limit"] : 2e4;
+    message = `overlay_too_large: the overlay exceeds ${limit} paths. Sync against a newer base commit.`;
+  }
+  if (code2 === "unexpected_blob")
+    message = "unexpected_blob: no open sync names this upload. Retry code sync to reconcile the overlay; base blobs are never uploaded.";
+  if (code2 === "stale_policy")
+    message = "stale_policy: the upload policy kept changing; retry code sync to fetch the policy and rescan.";
+  if (code2 === "not_view_owner")
+    message = "not_view_owner: this code view belongs to another member; sync your own worktree.";
+  if (code2 === "insufficient_scope" || code2 === "missing_scope")
+    message = "Code commands need harness:read; sync and base status also need harness:write.";
+  return new HttpError(error.status, message, error.body, error.retryAfter);
+}
+async function responseText(response, maxBytes) {
+  if (maxBytes === void 0) return response.text();
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const part = await reader.read();
+      if (part.done) break;
+      size += part.value.byteLength;
+      if (size > maxBytes) {
+        void reader.cancel().catch(() => {
+        });
+        throw new CommandError("The code query response exceeds the 16 MiB size limit; narrow the query.");
+      }
+      chunks.push(Buffer.from(part.value));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+  } catch {
+    throw new CommandError("The code query response is not valid UTF-8.");
+  }
+}
+var HttpCodeApi = class {
+  constructor(config, options = {}) {
+    this.config = config;
+    this.origin = config.baseUrl;
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+    this.sleep = options.sleep ?? delay;
+  }
+  config;
+  origin;
+  fetchImpl;
+  sleep;
+  async request(method, path, body, maxResponseBytes) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        const headers = {
+          authorization: `Bearer ${this.config.token}`,
+          "x-harness-cli-version": CLI_VERSION
+        };
+        const encoded = body === void 0 ? void 0 : Buffer.isBuffer(body) ? body : JSON.stringify(body);
+        if (body !== void 0)
+          headers["content-type"] = Buffer.isBuffer(body) ? "application/octet-stream" : "application/json";
+        const response = await this.fetchImpl(
+          new URL(this.origin + "/api/v1/code" + path),
+          {
+            method,
+            headers,
+            body: encoded,
+            signal: AbortSignal.timeout(3e4),
+            redirect: "manual"
+          }
+        );
+        const retryAfter = retryAfterMs(response.headers.get("retry-after"));
+        const text = await responseText(response, maxResponseBytes);
+        let json2 = {};
+        if (text) {
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
+              json2 = parsed;
+            else if (response.ok)
+              throw new CommandError(
+                "The code index API returned an invalid JSON envelope."
+              );
+          } catch (error) {
+            if (response.ok)
+              throw error instanceof CommandError ? error : new CommandError(
+                "The code index API returned a non-JSON body."
+              );
+          }
+        }
+        if (!response.ok) {
+          const message = typeof json2["message"] === "string" ? json2["message"] : `Code index request refused (HTTP ${response.status}).`;
+          if (response.status === 426)
+            throw new UpgradeRequiredError(message, json2);
+          throw new HttpError(
+            response.status,
+            message,
+            json2,
+            response.headers.get("retry-after")
+          );
+        }
+        return { data: json2["data"], meta: json2["meta"], retryAfter };
+      } catch (error) {
+        if (error instanceof UpgradeRequiredError || error instanceof CommandError)
+          throw error;
+        const transient = error instanceof HttpError ? [429, 500, 502, 503, 504].includes(error.status) : true;
+        if (!transient || attempt === 2) {
+          if (error instanceof HttpError) throw error;
+          throw new TransportError(
+            "Code index request did not complete. Retry this command with the same worktree to resume."
+          );
+        }
+        const backoff = error instanceof HttpError ? retryAfterMs(error.retryAfter) : void 0;
+        const wait = backoff ?? 250 * 2 ** attempt;
+        if (wait > 3e5)
+          throw error instanceof HttpError ? error : new TransportError(
+            "The code index retry backoff is too long; retry later."
+          );
+        await this.sleep(wait);
+      }
+    }
+    throw new CommandError("Code index retry limit exceeded.");
+  }
+  async query(id, operation, p) {
+    const root = `/views/${encodeURIComponent(id)}`;
+    if (operation === "affected") {
+      const result2 = await this.request("POST", root + "/affected", {
+        symbol_ids: p.symbols ?? [],
+        paths: p.files ?? [],
+        ...p.depth !== void 0 ? { depth: p.depth } : {},
+        ...p.includeAmbiguous !== void 0 ? { include_ambiguous: p.includeAmbiguous } : {},
+        ...p.includeTypes !== void 0 ? { include_types: p.includeTypes } : {}
+      }, 16 * 1024 * 1024);
+      return { data: result2.data, meta: result2.meta };
+    }
+    const path = operation === "explain" ? root + `/symbols/${encodeURIComponent(p.symbol)}` : root + (operation === "search" ? "/symbols" : "/context");
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(operation === "search" ? { q: p.q, kind: p.kind, path_prefix: p.pathPrefix, limit: p.limit } : operation === "explain" ? { budget_tokens: p.budgetTokens } : { q: p.q, symbol_id: p.symbol, budget_tokens: p.budgetTokens })) {
+      if (value !== void 0) params.set(key, String(value));
+    }
+    const result = await this.request("GET", path + (params.size ? "?" + params.toString() : ""), void 0, 16 * 1024 * 1024);
+    return { data: result.data, meta: result.meta };
+  }
+  async getPolicy() {
+    return decode(policy, (await this.request("GET", "/policy")).data);
+  }
+  async putRepository(repoKey) {
+    return decode(
+      z.object({ repository_id: UUID, repo_key: z.string() }),
+      (await this.request("PUT", "/repositories", { repo_key: repoKey })).data
+    );
+  }
+  async getBase(repositoryId, commit, skipped) {
+    const r = await this.request(
+      "GET",
+      `/repositories/${encodeURIComponent(repositoryId)}/bases/${encodeURIComponent(commit)}${skipped ? "?skipped=true" : ""}`
+    );
+    const data = decode(base, r.data);
+    const wait = Math.max(data.retry_after_ms ?? 0, r.retryAfter ?? 0);
+    return wait ? { ...data, retry_after_ms: wait } : data;
+  }
+  async putView(repositoryId, key) {
+    return decode(
+      view,
+      (await this.request(
+        "PUT",
+        `/repositories/${encodeURIComponent(repositoryId)}/views/${encodeURIComponent(key)}`,
+        {}
+      )).data
+    );
+  }
+  async getView(id) {
+    return decode(
+      view,
+      (await this.request("GET", `/views/${encodeURIComponent(id)}`)).data
+    );
+  }
+  async openSync(id, body) {
+    return decode(
+      opened,
+      (await this.request("POST", `/views/${encodeURIComponent(id)}/syncs`, {
+        ...body
+      })).data
+    );
+  }
+  async putBlob(hash2, bytes) {
+    HASH.parse(hash2);
+    await this.request("PUT", `/blobs/${hash2}`, bytes);
+  }
+  async getSync(viewId, syncId) {
+    return decode(syncStatus, (await this.request(
+      "GET",
+      `/views/${encodeURIComponent(viewId)}/syncs/${encodeURIComponent(syncId)}`
+    )).data);
+  }
+  async activate(viewId, syncId) {
+    return decode(
+      activated,
+      (await this.request(
+        "POST",
+        `/views/${encodeURIComponent(viewId)}/syncs/${encodeURIComponent(syncId)}/activate`,
+        {}
+      )).data
+    );
+  }
+};
+
+// src/core/code/sync.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { setTimeout as delay2 } from "timers/promises";
+
+// src/core/code/git.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { realpath } from "fs/promises";
+var run2 = promisify(execFile);
+var MAX_GIT_BYTES = 16 * 1024 * 1024;
+async function gitBytes(cwd, args, maxBuffer = MAX_GIT_BYTES) {
+  try {
+    return (await run2(
+      "git",
+      [
+        "--no-optional-locks",
+        "--no-pager",
+        "-c",
+        "core.fsmonitor=false",
+        ...args
+      ],
+      { cwd, maxBuffer, timeout: 3e4, encoding: "buffer" }
+    )).stdout;
+  } catch (error) {
+    const code2 = error.code;
+    if (code2 === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" || error instanceof Error && /maxBuffer/i.test(error.message))
+      throw new LocalError(
+        "Git returned more than 16 MiB of metadata; narrow the worktree before code sync."
+      );
+    throw new LocalError(
+      "Cannot read this Git working tree. Run code commands inside a committed repository with an origin remote."
+    );
+  }
+}
+function decodeUtf8(value, message) {
+  const decoded = value.toString("utf8");
+  if (!Buffer.from(decoded, "utf8").equals(value)) throw new LocalError(message);
+  return decoded;
+}
+function decodeGitPaths(outputs) {
+  const paths = [];
+  for (const output of outputs) {
+    if (output.length > 0 && output.at(-1) !== 0)
+      throw new LocalError("Code sync received an incomplete Git path record.");
+    let start = 0;
+    for (let end = output.indexOf(0, start); end !== -1; end = output.indexOf(0, start)) {
+      if (end === start)
+        throw new LocalError("Code sync received an empty Git path record.");
+      const path = decodeUtf8(
+        output.subarray(start, end),
+        "Code sync cannot safely index a Git path with invalid UTF-8."
+      );
+      if (/[\x00-\x1f\x7f-\x9f]/.test(path))
+        throw new LocalError(
+          "Code sync cannot safely index a Git path with control characters."
+        );
+      paths.push(path);
+      start = end + 1;
+    }
+  }
+  return paths;
+}
+function decodeGitLine(output, message) {
+  if (output.length === 0 || output.at(-1) !== 10)
+    throw new LocalError(message);
+  return decodeUtf8(output.subarray(0, -1), message);
+}
+function assertDistinctPathIdentities(paths) {
+  const known = /* @__PURE__ */ new Map();
+  for (const path of paths) {
+    let original = "";
+    let folded = "";
+    for (const part of path.split("/")) {
+      original += `/${part}`;
+      folded += `/${part.normalize("NFC").toLocaleLowerCase("en-US").toLocaleUpperCase("en-US").normalize("NFC")}`;
+      const previous = known.get(folded);
+      if (previous !== void 0 && previous !== original)
+        throw new LocalError(
+          "Code sync cannot safely distinguish colliding Git path identities."
+        );
+      known.set(folded, original);
+    }
+  }
+}
+async function identity(cwd) {
+  const rootRecord = decodeGitLine(
+    await gitBytes(cwd, ["rev-parse", "--show-toplevel"]),
+    "Cannot resolve the Git working tree root safely."
+  );
+  if (/[\x00-\x1f\x7f-\x9f]/.test(rootRecord))
+    throw new LocalError("Cannot resolve the Git working tree root safely.");
+  const root = await realpath(rootRecord);
+  const commit = decodeGitLine(
+    await gitBytes(root, ["rev-parse", "--verify", "HEAD^{commit}"]),
+    "Cannot resolve the repository HEAD commit."
+  );
+  const remote = decodeGitLine(
+    await gitBytes(root, ["remote", "get-url", "origin"]),
+    "repository_not_connected: code indexing requires an origin on github.com shared through your organization\u2019s Harness GitHub connection."
+  );
+  if (/[\x00-\x1f\x7f-\x9f]/.test(remote))
+    throw new LocalError(
+      "repository_not_connected: code indexing requires an origin on github.com shared through your organization\u2019s Harness GitHub connection."
+    );
+  const scp = /^(?:git@)?github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/i.exec(remote);
+  let parts;
+  if (scp) parts = [scp[1], scp[2]];
+  else {
+    try {
+      const url = new URL(remote);
+      if (["https:", "ssh:", "git:"].includes(url.protocol) && url.hostname.toLowerCase() === "github.com" && !url.password && !url.search && !url.hash && (!url.port || url.protocol === "ssh:")) {
+        parts = url.pathname.replace(/^\//, "").replace(/\/$/, "").replace(/\.git$/, "").split("/");
+      }
+    } catch {
+    }
+  }
+  if (!parts || parts.length !== 2 || parts.some((p) => !p || !/^[\w.-]+$/.test(p) || p === "." || p === ".."))
+    throw new LocalError(
+      "repository_not_connected: code indexing requires an origin on github.com shared through your organization\u2019s Harness GitHub connection."
+    );
+  if (!/^[0-9a-f]{40,64}$/.test(commit))
+    throw new LocalError("Cannot resolve the repository HEAD commit.");
+  return {
+    root,
+    commit,
+    repoKey: `github.com/${parts.join("/").toLowerCase()}`
+  };
+}
+async function changedPaths(root, commit) {
+  const changed = await gitBytes(root, [
+    "diff",
+    "--name-only",
+    "-z",
+    "--no-renames",
+    "--no-ext-diff",
+    "--no-textconv",
+    commit,
+    "--"
+  ]);
+  const untracked = await gitBytes(root, [
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "-z"
+  ]);
+  return [
+    ...new Set(decodeGitPaths([changed, untracked]))
+  ].sort(
+    (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b))
+  );
+}
+
+// src/core/code/scan.ts
+import { constants as constants2 } from "fs";
+import { open } from "fs/promises";
+import { join } from "path";
+import { createHash } from "crypto";
+import { release } from "os";
+
+// src/core/code/policy.ts
+import { isUtf8 } from "buffer";
+import { extname } from "path";
+
+// src/core/code/glob.ts
+var MAX_PATTERN_BYTES = 256;
+var MAX_PATTERN_STARS = 8;
+var MAX_PATTERNS = 1e3;
+function compileIgnorePatterns(lines, warnings) {
+  const patterns = [];
+  for (const [line, raw] of lines.entries()) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    if (trimmed.startsWith("!")) {
+      warnings.push(
+        `Ignoring .harnesscodeignore negation on line ${line + 1}; code-index patterns do not support !.`
+      );
+      continue;
+    }
+    if (trimmed.includes("\\")) {
+      warnings.push(
+        `The .harnesscodeignore backslash on line ${line + 1} is literal and never matches a normalized source path.`
+      );
+    }
+    if (Buffer.byteLength(trimmed) > MAX_PATTERN_BYTES || (trimmed.match(/\*/g)?.length ?? 0) > MAX_PATTERN_STARS) {
+      warnings.push(
+        "Ignoring .harnesscodeignore pattern outside the code-index size limits."
+      );
+      continue;
+    }
+    if (patterns.length === MAX_PATTERNS) {
+      warnings.push(
+        "Ignoring .harnesscodeignore patterns after the first 1,000 valid entries."
+      );
+      break;
+    }
+    const pattern = compilePattern(trimmed);
+    if (pattern) patterns.push(pattern);
+  }
+  return patterns;
+}
+function patternLimitError() {
+  return new Error("Code upload policy contains an invalid path pattern.");
+}
+function escapeRegex(pattern) {
+  return pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function globBody(pattern) {
+  return escapeRegex(pattern).replaceAll("\\*\\*/", "(?:.*/)?").replaceAll("/\\*\\*", "/.*").replaceAll("\\*", "[^/]*").replaceAll("\\?", "[^/]");
+}
+function compilePattern(raw, {
+  caseInsensitive = false,
+  mode = "ignore",
+  warnings,
+  maxPatternBytes = MAX_PATTERN_BYTES,
+  maxStars = MAX_PATTERN_STARS,
+  rejectUnsupported = false
+} = {}) {
+  let pattern = mode === "served" ? raw : raw.trim();
+  if (pattern === "") return null;
+  if (pattern.startsWith("#")) {
+    if (rejectUnsupported) throw patternLimitError();
+    return null;
+  }
+  if (Buffer.byteLength(pattern) > maxPatternBytes || (pattern.match(/\*/g)?.length ?? 0) > maxStars)
+    throw patternLimitError();
+  if (pattern.startsWith("!")) {
+    if (rejectUnsupported) throw patternLimitError();
+    warnings?.push(
+      "Ignoring .harnesscodeignore negation; code-index patterns do not support !."
+    );
+    return null;
+  }
+  if (pattern.includes("\\")) {
+    if (rejectUnsupported) throw patternLimitError();
+    warnings?.push(
+      "A .harnesscodeignore backslash is literal, not an escape."
+    );
+  }
+  if (rejectUnsupported && /[\[\]{}]/.test(pattern)) throw patternLimitError();
+  const anchored = pattern.includes("/");
+  if (mode === "ignore") pattern = pattern.replace(/^\/+|\/+$/g, "");
+  const prefix = anchored ? "^" : "^(?:.*/)?";
+  const suffix = mode === "ignore" ? "(?:/.*)?$" : "$";
+  return {
+    source: mode === "served" ? raw : raw.trim(),
+    negated: false,
+    regex: new RegExp(
+      prefix + globBody(pattern) + suffix,
+      caseInsensitive ? "i" : ""
+    )
+  };
+}
+function compilePatterns(lines, options = {}) {
+  const maxPatterns = options.maxPatterns ?? MAX_PATTERNS;
+  if (lines.length > maxPatterns) throw patternLimitError();
+  return lines.map((line) => compilePattern(line, options)).filter((pattern) => pattern !== null);
+}
+function matchingPattern(path, patterns) {
+  let decided = null;
+  for (const pattern of patterns) if (pattern.regex.test(path)) decided = pattern;
+  return decided;
+}
+
+// src/core/code/policy.ts
+var MAX_FILE_BYTES = 1048576;
+var EXTENSIONS = [
+  ".ex",
+  ".exs",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".swift"
+];
+var DENY = [
+  ".env",
+  ".env.*",
+  "secrets/**",
+  "**/secrets/**",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.pfx",
+  "*.jks",
+  "*.keystore",
+  "id_rsa*",
+  "id_ecdsa*",
+  "id_ed25519*",
+  "*.kdbx",
+  ".npmrc",
+  ".netrc",
+  "credentials.json",
+  "**/.aws/**",
+  ".git/**",
+  "node_modules/**",
+  "_build/**",
+  "deps/**",
+  "dist/**",
+  "*.lock",
+  "package-lock.json",
+  "*.min.js",
+  "*.map",
+  "priv/static/**",
+  "src/generated/**",
+  "DerivedData/**",
+  "**/DerivedData/**",
+  ".build/**",
+  "**/.build/**",
+  "Pods/**",
+  "Carthage/Build/**",
+  "xcuserdata/**",
+  "**/xcuserdata/**",
+  "*.xcuserstate",
+  "*.xcresult/**",
+  "*.xcarchive/**",
+  "*.dSYM/**",
+  "*.ipa",
+  "*.secret.exs"
+];
+var SECRET_PATTERN_SOURCES = [
+  "-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----",
+  "\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b",
+  "\\baone_[A-Za-z0-9_-]{20,}",
+  "\\bgh[opsur]_[A-Za-z0-9]{36}\\b",
+  "\\b[rs]k_live_[A-Za-z0-9]{20,}",
+  "\\bAIza[0-9A-Za-z_-]{35}\\b",
+  "\\bxapp-\\d-[A-Za-z0-9-]{20,}",
+  "hooks\\.slack\\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+",
+  "\\bgithub_pat_[A-Za-z0-9_]{22,}",
+  "\\bxox[baprs]-\\d{8,}-[A-Za-z0-9-]{10,}",
+  "\\bsk-(?:proj-|ant-[a-z0-9]+-)?[A-Za-z0-9_-]{32,}"
+];
+var SECRETS = SECRET_PATTERN_SOURCES.map((source) => new RegExp(source));
+function contentMatchers(patterns) {
+  const literalMarkers = [];
+  for (const pattern of patterns) {
+    if (SECRET_PATTERN_SOURCES.includes(pattern)) continue;
+    if (!pattern || /[\\^$.*+?()[\]{}|]/.test(pattern))
+      throw new Error("unknown regular expression");
+    literalMarkers.push(pattern);
+  }
+  return literalMarkers;
+}
+function servedCase(served) {
+  const value = served.deny_glob_case;
+  if (value !== void 0 && value !== "ascii_insensitive")
+    throw new Error("unknown deny glob case mode");
+  return value;
+}
+function buildPolicy(served, ignore, includeFloor) {
+  const warnings = [];
+  const unsupported = [...new Set(
+    served.include_extensions.filter((extension) => !EXTENSIONS.includes(extension))
+  )].sort();
+  if (unsupported.length)
+    warnings.push(
+      `This harness-cli does not send ${unsupported.join(", ")} files; upgrade the client.`
+    );
+  const insensitiveServed = servedCase(served) === "ascii_insensitive";
+  const literalMarkers = contentMatchers(served.content_patterns);
+  return {
+    limit: Math.min(served.max_file_bytes, MAX_FILE_BYTES),
+    deny: [
+      ...includeFloor ? compilePatterns(DENY, {
+        caseInsensitive: true,
+        maxPatterns: Infinity,
+        maxPatternBytes: Infinity,
+        maxStars: Infinity
+      }) : [],
+      ...compilePatterns(served.deny_globs, {
+        caseInsensitive: includeFloor || insensitiveServed,
+        mode: "served",
+        maxPatternBytes: 1024,
+        maxStars: Infinity,
+        rejectUnsupported: true
+      })
+    ],
+    ignore: compileIgnorePatterns(ignore.split(/\r?\n/), warnings),
+    patterns: SECRETS,
+    literalMarkers,
+    extensions: new Set(
+      EXTENSIONS.filter((extension) => served.include_extensions.includes(extension))
+    ),
+    warnings
+  };
+}
+function policyFor(served, ignore) {
+  try {
+    return buildPolicy(served, ignore, true);
+  } catch {
+    throw new CommandError(
+      "The server returned an invalid code upload policy; upgrade the client before code sync."
+    );
+  }
+}
+function basePolicyFor(served, ignore) {
+  try {
+    return buildPolicy(served, ignore, false);
+  } catch {
+    throw new CommandError(
+      "The server returned an invalid code upload policy; upgrade the client before code sync."
+    );
+  }
+}
+function pathReason(path, p) {
+  if (!path || Buffer.byteLength(path) > 1024 || /[\\\x00-\x1f\x7f-\x9f]/.test(path) || Buffer.from(path, "utf8").toString("utf8") !== path || path.split("/").some((segment) => ["", ".", ".."].includes(segment)))
+    return "invalid_path";
+  if (p.deny.some((pattern) => pattern.regex.test(path))) return "excluded_path";
+  if (matchingPattern(path, p.ignore)) return "ignored";
+  return p.extensions.has(extname(path)) ? null : "unsupported_language";
+}
+function extensionWarning(path, p) {
+  const extension = extname(path);
+  return !p.extensions.has(extension) && p.extensions.has(extension.toLowerCase()) ? `The server indexes ${extension.toLowerCase()} exactly; ${path} was skipped.` : null;
+}
+function contentReason(bytes, p) {
+  if (bytes.length > p.limit) return "too_large";
+  if (bytes.includes(0) || !isUtf8(bytes)) return "binary";
+  const text = bytes.toString("utf8");
+  return p.patterns.some((pattern) => pattern.test(text)) || p.literalMarkers.some((marker) => text.includes(marker)) ? "secret_content" : null;
+}
+
+// src/core/code/scan.ts
+var MAX_OVERLAY_BYTES = 64 * 1024 * 1024;
+var MAX_OVERLAY_CHANGES = 2e4;
+var O_NOFOLLOW_ANY = 536870912;
+function sha256(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+function supportsDarwinNoFollowAny(osRelease = release()) {
+  const major = Number(osRelease.split(".")[0]);
+  return Number.isInteger(major) && major >= 20;
+}
+async function committedIgnore(root, commit) {
+  const entry = decodeUtf8(
+    await gitBytes(root, [
+      "ls-tree",
+      "-z",
+      commit,
+      "--",
+      ".harnesscodeignore"
+    ]),
+    "Cannot read the committed .harnesscodeignore safely."
+  );
+  if (!entry) return "";
+  const match = /^(\d+) blob ([0-9a-f]+)\t\.harnesscodeignore\0$/.exec(entry);
+  if (!match || !["100644", "100755"].includes(match[1]))
+    throw new LocalError(
+      "The committed .harnesscodeignore must be a regular file before code sync."
+    );
+  return decodeUtf8(
+    await gitBytes(root, ["cat-file", "blob", match[2]], 65537),
+    "The committed .harnesscodeignore must be valid UTF-8 before code sync."
+  );
+}
+var directoryFlags = constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK;
+async function openLinuxRoot(root) {
+  let handle;
+  try {
+    if (!root.startsWith("/"))
+      throw new Error("repository root is not absolute");
+    handle = await open("/", directoryFlags);
+    for (const part of root.split("/").filter(Boolean)) {
+      if (part === "." || part === "..")
+        throw new Error("repository root is invalid");
+      const next = await open(
+        `/proc/self/fd/${handle.fd}/${part}`,
+        directoryFlags
+      );
+      await handle.close();
+      handle = next;
+    }
+    return handle;
+  } catch {
+    await handle?.close().catch(() => {
+    });
+    throw new LocalError(
+      "Code sync cannot establish a safe source root on this platform."
+    );
+  }
+}
+async function openLinuxBelowRoot(root, path) {
+  let handle = await openLinuxRoot(root);
+  try {
+    const parts = path.split("/");
+    for (const [index, part] of parts.entries()) {
+      if (!part || part === "." || part === "..")
+        throw new LocalError(
+          "Cannot read an overlay file safely; invalid path."
+        );
+      const next = await open(
+        `/proc/self/fd/${handle.fd}/${part}`,
+        constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK | (index === parts.length - 1 ? 0 : constants2.O_DIRECTORY)
+      );
+      await handle.close();
+      handle = next;
+    }
+    return handle;
+  } catch (error) {
+    await handle.close().catch(() => {
+    });
+    throw error;
+  }
+}
+async function openSafe(root, path) {
+  if (process.platform === "darwin") {
+    if (!supportsDarwinNoFollowAny())
+      throw new LocalError(
+        "Code sync requires macOS 11 or later for safe source reads."
+      );
+    return open(
+      join(root, path),
+      constants2.O_RDONLY | O_NOFOLLOW_ANY | constants2.O_NONBLOCK
+    );
+  }
+  if (process.platform === "linux") return openLinuxBelowRoot(root, path);
+  throw new LocalError(
+    "Code sync cannot safely read source files on this platform."
+  );
+}
+async function readSafe(root, path, limit) {
+  try {
+    const handle = await openSafe(root, path);
+    try {
+      const before = await handle.stat();
+      if (!before.isFile()) return { reason: "not_regular_file" };
+      if (before.size > limit) return { reason: "too_large" };
+      const bytes = Buffer.allocUnsafe(Math.min(before.size, limit) + 1);
+      let total = 0;
+      while (total < bytes.length) {
+        const { bytesRead } = await handle.read(
+          bytes,
+          total,
+          bytes.length - total,
+          null
+        );
+        if (bytesRead === 0) break;
+        total += bytesRead;
+      }
+      const after = await handle.stat();
+      if (total > limit) return { reason: "too_large" };
+      if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || total !== after.size)
+        throw new LocalError(
+          "A source file changed during scanning; retry code sync."
+        );
+      return {
+        bytes: bytes.subarray(0, total),
+        mode: before.mode & 64 ? "100755" : "100644"
+      };
+    } finally {
+      await handle.close();
+    }
+  } catch (error) {
+    const code2 = error.code;
+    if (code2 === "ENOENT") return { reason: "deleted" };
+    if (code2 === "ELOOP" || code2 === "ENOTDIR") return { reason: "symlink" };
+    if (error instanceof LocalError) throw error;
+    throw new LocalError(
+      "Cannot read an overlay file safely; check permissions and retry code sync."
+    );
+  }
+}
+async function scanOverlay(id, served) {
+  policyFor(served, "");
+  const ignore = await readSafe(id.root, ".harnesscodeignore", 65536);
+  if ("reason" in ignore && ignore.reason !== "deleted")
+    throw new LocalError(
+      "Cannot read .harnesscodeignore safely; fix or remove it before code sync."
+    );
+  const localIgnore = "bytes" in ignore ? decodeUtf8(
+    ignore.bytes,
+    "The local .harnesscodeignore must be valid UTF-8 before code sync."
+  ) : "";
+  const baseIgnore = await committedIgnore(id.root, id.commit);
+  if (Buffer.byteLength(baseIgnore) > 65536)
+    throw new LocalError(
+      "The committed .harnesscodeignore exceeds 64 KiB; reduce it before code sync."
+    );
+  const policy2 = policyFor(served, localIgnore);
+  const basePolicy = basePolicyFor(served, baseIgnore);
+  const paths = await changedPaths(id.root, id.commit);
+  const basePaths = new Set(
+    decodeGitPaths([
+      await gitBytes(id.root, ["ls-tree", "-r", "--name-only", "-z", id.commit])
+    ])
+  );
+  assertDistinctPathIdentities([...basePaths, ...paths]);
+  const changes = [];
+  const deleted = /* @__PURE__ */ new Set();
+  const blobs = /* @__PURE__ */ new Map();
+  const excluded = [];
+  const baseWouldHold = (path) => basePaths.has(path) && pathReason(path, basePolicy) === null;
+  const deleteBasePath = (path) => {
+    if (baseWouldHold(path) && !deleted.has(path)) {
+      if (changes.length >= MAX_OVERLAY_CHANGES)
+        throw new LocalError(
+          `overlay_too_large: the overlay exceeds ${MAX_OVERLAY_CHANGES} entries. Commit the ignore file so the base honors it.`
+        );
+      deleted.add(path);
+      changes.push({ op: "delete", path });
+    }
+  };
+  const candidates = new Set(paths);
+  const warnings = /* @__PURE__ */ new Set([...policy2.warnings, ...basePolicy.warnings]);
+  for (const path of basePaths) {
+    const baseReason = pathReason(path, basePolicy);
+    const localReason = pathReason(path, policy2);
+    if (baseReason === null && (localReason === "excluded_path" || localReason === "ignored"))
+      deleteBasePath(path);
+    if (baseReason === "ignored" && localReason === null) candidates.add(path);
+  }
+  let total = 0;
+  for (const path of [...candidates].sort(
+    (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b))
+  )) {
+    const reason = pathReason(path, policy2);
+    if (reason) {
+      excluded.push({ path, reason });
+      if (reason === "ignored" || reason === "excluded_path") deleteBasePath(path);
+      const warning = extensionWarning(path, policy2);
+      if (warning) warnings.add(warning);
+      continue;
+    }
+    const read = await readSafe(id.root, path, policy2.limit);
+    if ("reason" in read) {
+      if (read.reason !== "deleted")
+        excluded.push({ path, reason: read.reason });
+      deleteBasePath(path);
+      continue;
+    }
+    const content = contentReason(read.bytes, policy2);
+    if (content) {
+      excluded.push({ path, reason: content });
+      deleteBasePath(path);
+      continue;
+    }
+    const hash2 = sha256(read.bytes);
+    if (!blobs.has(hash2)) {
+      total += read.bytes.length;
+      if (total > MAX_OVERLAY_BYTES)
+        throw new LocalError(
+          "The overlay exceeds the 64 MiB client upload limit; split the change before syncing."
+        );
+      blobs.set(hash2, read.bytes);
+    }
+    if (changes.length >= MAX_OVERLAY_CHANGES)
+      throw new LocalError(
+        `overlay_too_large: the overlay exceeds ${MAX_OVERLAY_CHANGES} entries. Commit the ignore file so the base honors it.`
+      );
+    changes.push({
+      op: "put",
+      path,
+      sha256: hash2,
+      size: read.bytes.length,
+      mode: read.mode
+    });
+  }
+  changes.sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)));
+  const digest = sha256(
+    changes.map(
+      (c) => c.op === "delete" ? `${c.path}\0-\0-
+` : `${c.path}\0${c.sha256}\0${c.mode}
+`
+    ).join("")
+  );
+  return {
+    changes,
+    blobs,
+    excluded,
+    warnings: [...warnings],
+    digest
+  };
+}
+
+// src/core/code/state.ts
+import {
+  readFile,
+  mkdir,
+  writeFile,
+  rename,
+  unlink,
+  rmdir
+} from "fs/promises";
+import { join as join2, resolve, isAbsolute } from "path";
+import { randomUUID } from "crypto";
+function statePath(server, org, root, repoKey, directory) {
+  const url = new URL(server);
+  const canonical = url.origin + url.pathname.replace(/\/+$/, "");
+  const base2 = directory ?? process.env["HARNESS_CODE_STATE_DIR"] ?? join2(resolveCacheHome(), "harness", "code");
+  if (!isAbsolute(base2))
+    throw new LocalError("HARNESS_CODE_STATE_DIR must be an absolute path.");
+  return join2(
+    resolve(base2),
+    sha256(JSON.stringify([canonical, org.toLowerCase()])),
+    sha256(JSON.stringify([root, repoKey])) + ".json"
+  );
+}
+async function readState(path, server, org, root, repoKey) {
+  try {
+    const s = JSON.parse(await readFile(path, "utf8"));
+    if (typeof s !== "object" || s === null) throw new Error();
+    const state2 = s;
+    if (state2.org.toLowerCase() !== org.toLowerCase() || state2.root !== root || state2.repoKey !== repoKey || new URL(state2.server).href !== new URL(server).href || typeof state2.viewKey !== "string" || !/^[\da-f-]{36}$/.test(state2.viewKey))
+      throw new Error();
+    return { ...state2, org: state2.org.toLowerCase() };
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new LocalError(
+      "The code view state is invalid or belongs to another scope. Check HARNESS_CODE_STATE_DIR; no source was uploaded."
+    );
+  }
+}
+async function initialState(path, server, org, root, repoKey) {
+  const previous = await readState(path, server, org, root, repoKey);
+  if (previous) return previous;
+  const state2 = { server, org: org.toLowerCase(), root, repoKey, viewKey: randomUUID() };
+  await mkdir(join2(path, ".."), { recursive: true, mode: 448 });
+  try {
+    await writeFile(path, JSON.stringify(state2) + "\n", {
+      flag: "wx",
+      mode: 384
+    });
+    return state2;
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      const raced = await readState(path, server, org, root, repoKey);
+      if (raced) return raced;
+    }
+    throw new LocalError("Cannot save isolated code view state.");
+  }
+}
+async function saveState(path, state2) {
+  const tmp = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(tmp, JSON.stringify({ ...state2, org: state2.org.toLowerCase() }) + "\n", {
+      flag: "wx",
+      mode: 384
+    });
+    await rename(tmp, path);
+  } catch {
+    throw new LocalError(
+      "Cannot save code sync progress; retry with the same worktree and state directory."
+    );
+  } finally {
+    await unlink(tmp).catch(() => {
+    });
+  }
+}
+async function withSyncLock(path, action) {
+  const lock = path + ".lock";
+  await mkdir(join2(path, ".."), { recursive: true, mode: 448 });
+  try {
+    await mkdir(lock, { mode: 448 });
+  } catch (error) {
+    if (error.code === "EEXIST")
+      throw new LocalError(
+        `A code sync is already running for this view. Wait for it to finish. If it was interrupted, confirm no sync is running before removing its lock directory: ${lock}`
+      );
+    throw new LocalError(
+      "Cannot lock code sync progress; check the state directory permissions."
+    );
+  }
+  try {
+    await writeFile(join2(lock, "owner"), `${process.pid}
+`, {
+      flag: "wx",
+      mode: 384
+    });
+    return await action();
+  } finally {
+    await unlink(join2(lock, "owner")).catch(() => {
+    });
+    try {
+      await rmdir(lock);
+    } catch {
+      try {
+        process.stderr.write(named(
+          `harness: Warning: code sync lock cleanup failed at ${clean(lock)}. If the lock remains, confirm no sync is running before removing it.
+`
+        ));
+      } catch {
+      }
+    }
+  }
+}
+
+// src/core/code/sync.ts
+async function baseReady(api, repo, commit, options) {
+  const timeout = options.pollTimeoutMs ?? 6e5;
+  const sleep = options.sleep ?? delay2;
+  let waited = 0;
+  let interval = 1e3;
+  const started = Date.now();
+  for (let attempts = 0; attempts < 600; attempts++) {
+    const base2 = await api.getBase(repo, commit, options.skipped === true);
+    if (base2.state === "complete" || base2.state === "ready") return base2;
+    if (base2.state === "failed")
+      throw new CommandError(
+        "The server could not build this commit\u2019s base. Check code status --skipped, then retry after the server backoff."
+      );
+    const backoff = base2.retry_after_ms === 0 ? interval : base2.retry_after_ms ?? interval;
+    if (!Number.isFinite(backoff) || backoff < 0 || Math.max(waited, Date.now() - started) + backoff > timeout)
+      throw new CommandError(
+        "Timed out waiting for the server-built base; retry code sync to resume."
+      );
+    await sleep(backoff);
+    waited += backoff;
+    interval = Math.min(interval * 2, 1e4);
+  }
+  throw new CommandError("The base is still fetching; retry code sync later.");
+}
+function stale(error) {
+  return error instanceof HttpError && error.status === 409 && error.body["error"] === "stale_policy";
+}
+function withinActivationRetention(attemptedAt) {
+  const elapsed = typeof attemptedAt === "number" ? Date.now() - attemptedAt : NaN;
+  return Number.isFinite(elapsed) && elapsed >= 0 && elapsed < 60 * 6e4;
+}
+var ReplacedSyncError = class extends CommandError {
+  constructor() {
+    super(
+      "The server replaced this sync before activation. Retry code sync with no other sync running for this view."
+    );
+  }
+};
+function policyScope(policy2) {
+  if (!/^[\da-f]{8}-(?:[\da-f]{4}-){3}[\da-f]{12}$/i.test(policy2.org_id) || !policy2.policy_digest || !Number.isSafeInteger(policy2.max_file_bytes) || policy2.max_file_bytes < 1)
+    throw new CommandError(
+      "The server did not provide a valid organization and upload policy; no source was uploaded."
+    );
+  policyFor(policy2, "");
+}
+async function syncCode(api, options) {
+  const id = await identity(options.cwd);
+  let policyRestarts = 0;
+  let syncRestarts = 0;
+  for (let restart = 0; restart < 3; restart++) {
+    const policy2 = await api.getPolicy();
+    policyScope(policy2);
+    const path = statePath(
+      api.origin,
+      policy2.org_id,
+      id.root,
+      id.repoKey,
+      options.stateDir
+    );
+    try {
+      return await withSyncLock(path, async () => {
+        const state2 = await initialState(
+          path,
+          api.origin,
+          policy2.org_id,
+          id.root,
+          id.repoKey
+        );
+        const repo = await api.putRepository(id.repoKey);
+        if (repo.repo_key !== id.repoKey)
+          throw new CommandError(
+            "The server resolved a different repository; no source was uploaded."
+          );
+        if (state2.repositoryId && state2.repositoryId !== repo.repository_id) {
+          delete state2.viewId;
+          delete state2.pending;
+          delete state2.activated;
+        }
+        state2.repositoryId = repo.repository_id;
+        state2.baseCommit = id.commit;
+        await saveState(path, state2);
+        const base2 = await baseReady(
+          api,
+          repo.repository_id,
+          id.commit,
+          options
+        );
+        if (base2.policy_digest && base2.policy_digest !== policy2.policy_digest)
+          throw new HttpError(409, "The upload policy changed", {
+            error: "stale_policy"
+          });
+        const overlay = await scanOverlay(id, policy2);
+        const view2 = await api.putView(repo.repository_id, state2.viewKey);
+        if (state2.viewId !== void 0 && state2.viewId !== view2.view_id && view2.repository_id === repo.repository_id && view2.view_key === state2.viewKey) {
+          let removed = false;
+          try {
+            await api.getView(state2.viewId);
+          } catch (error) {
+            if (error instanceof HttpError && error.status === 404)
+              removed = true;
+            else throw error;
+          }
+          if (removed) {
+            delete state2.viewId;
+            delete state2.pending;
+            delete state2.activated;
+          }
+        }
+        if (view2.repository_id !== repo.repository_id || view2.view_key !== state2.viewKey || state2.viewId !== void 0 && state2.viewId !== view2.view_id)
+          throw new CommandError(
+            "The server view does not match this repository/worktree; no source was uploaded."
+          );
+        state2.viewId = view2.view_id;
+        const forgetReplaced = async () => {
+          delete state2.pending;
+          await saveState(path, state2);
+          throw new ReplacedSyncError();
+        };
+        const receipt = async (syncId) => {
+          try {
+            const previous = await api.getSync(view2.view_id, syncId);
+            if (previous.id !== syncId)
+              throw new CommandError("The server returned a different sync; activation remains unverified.");
+            if (previous.state === "receiving") return null;
+            if (!Number.isSafeInteger(previous.version) || previous.version === null || previous.version < 1)
+              throw new CommandError("The server did not return an activation version; retry code status.");
+            return { pending_version: previous.version, state: previous.state };
+          } catch (error) {
+            if (error instanceof HttpError && error.status === 404) {
+              if (withinActivationRetention(state2.pending?.activationAttemptedAt))
+                return forgetReplaced();
+              throw new CommandError("The previous activation can no longer be verified after retention. Check code status before syncing again.");
+            }
+            throw error;
+          }
+        };
+        let current = state2.pending;
+        const matchesCurrent = current && current.digest === overlay.digest && current.request?.mode === "full" && current.request.base_commit === id.commit && current.request.policy_digest === policy2.policy_digest && typeof current.request.client_sync_id === "string" && JSON.stringify(current.request.changes) === JSON.stringify(overlay.changes);
+        if (current?.syncId && current.activationAttemptedAt !== void 0 && !matchesCurrent) {
+          const prior = current;
+          const originalSyncId = current.syncId;
+          let recovered = await receipt(originalSyncId);
+          if (!recovered) {
+            prior.activationAttemptedAt = Date.now();
+            await saveState(path, state2);
+            try {
+              recovered = await api.activate(view2.view_id, originalSyncId);
+            } catch (error) {
+              recovered = await receipt(originalSyncId);
+              if (!recovered) throw error;
+            }
+          }
+          state2.activated = {
+            baseCommit: prior.request.base_commit,
+            overlayDigest: prior.digest,
+            pendingVersion: recovered.pending_version,
+            policyDigest: prior.request.policy_digest
+          };
+          delete state2.pending;
+          await saveState(path, state2);
+          current = void 0;
+        }
+        const request = matchesCurrent && current ? current.request : {
+          client_sync_id: randomUUID2(),
+          base_commit: id.commit,
+          mode: "full",
+          changes: overlay.changes,
+          policy_digest: policy2.policy_digest
+        };
+        state2.pending = current && current.request === request ? current : { digest: overlay.digest, request };
+        await saveState(path, state2);
+        const finish = async (syncId, activated3, uploadedBlobs) => {
+          state2.activated = {
+            baseCommit: id.commit,
+            overlayDigest: overlay.digest,
+            pendingVersion: activated3.pending_version,
+            policyDigest: policy2.policy_digest
+          };
+          delete state2.pending;
+          await saveState(path, state2);
+          return {
+            repository_id: repo.repository_id,
+            repo_key: id.repoKey,
+            org_id: policy2.org_id,
+            view_id: view2.view_id,
+            view_key: state2.viewKey,
+            sync_id: syncId,
+            base_commit: id.commit,
+            base: base2,
+            overlay_digest: overlay.digest,
+            changed_files: overlay.changes.length,
+            uploaded_blobs: uploadedBlobs,
+            excluded: overlay.excluded,
+            warnings: overlay.warnings,
+            policy_restarts: policyRestarts,
+            sync_restarts: syncRestarts,
+            ...activated3
+          };
+        };
+        if (state2.pending.syncId && state2.pending.activationAttemptedAt !== void 0) {
+          const recovered = await receipt(state2.pending.syncId);
+          if (recovered) return finish(state2.pending.syncId, recovered, 0);
+        }
+        const opened2 = await api.openSync(view2.view_id, request);
+        if (opened2.rejected.length)
+          throw new CommandError(
+            `The server refused ${opened2.rejected.length} overlay entries; no sync was activated. Refetch the policy and check the skipped-files report.`
+          );
+        state2.pending.syncId = opened2.sync_id;
+        await saveState(path, state2);
+        if (opened2.state !== "receiving") {
+          const recovered = await receipt(opened2.sync_id);
+          if (recovered) return finish(opened2.sync_id, recovered, 0);
+          throw new CommandError("The server returned an inconsistent sync state; no new version was requested.");
+        }
+        const missing = [...new Set(opened2.missing)];
+        for (const hash2 of missing)
+          if (!overlay.blobs.has(hash2))
+            throw new CommandError(
+              "The server requested an unexpected blob not present in this overlay; no blobs were uploaded."
+            );
+        let activating = false;
+        let activated2;
+        try {
+          let next = 0;
+          let failure;
+          await Promise.all(Array.from({ length: Math.min(4, missing.length) }, async () => {
+            while (!failure && next < missing.length) {
+              const hash2 = missing[next++];
+              try {
+                await api.putBlob(hash2, overlay.blobs.get(hash2));
+              } catch (error) {
+                failure ??= { error };
+              }
+            }
+          }));
+          if (failure) throw failure.error;
+          state2.pending.activationAttemptedAt = Date.now();
+          await saveState(path, state2);
+          activating = true;
+          activated2 = await api.activate(view2.view_id, opened2.sync_id);
+        } catch (error) {
+          const replaced = error instanceof HttpError && (activating ? error.status === 404 : error.status === 409 && error.body["error"] === "unexpected_blob");
+          if (replaced) {
+            if (activating && !withinActivationRetention(state2.pending?.activationAttemptedAt))
+              throw new CommandError("The activation retry exceeded its retention window. Check code status before syncing again.");
+            return forgetReplaced();
+          }
+          const ambiguous = activating && (!(error instanceof HttpError) || error.status >= 500 || error.status === 429);
+          if (ambiguous) {
+            const recovered = await receipt(opened2.sync_id);
+            if (recovered) return finish(opened2.sync_id, recovered, missing.length);
+          }
+          throw error;
+        }
+        return finish(opened2.sync_id, activated2, missing.length);
+      });
+    } catch (error) {
+      if (stale(error) && restart < 2) {
+        policyRestarts++;
+        continue;
+      }
+      if (error instanceof ReplacedSyncError && restart < 2) {
+        syncRestarts++;
+        continue;
+      }
+      throw error;
+    }
+  }
+  throw new CommandError(
+    "The upload policy kept changing. Retry code sync after it settles."
+  );
+}
+async function statusCode(api, options) {
+  const id = await identity(options.cwd);
+  const policy2 = await api.getPolicy();
+  policyScope(policy2);
+  const path = statePath(
+    api.origin,
+    policy2.org_id,
+    id.root,
+    id.repoKey,
+    options.stateDir
+  );
+  const state2 = await readState(
+    path,
+    api.origin,
+    policy2.org_id,
+    id.root,
+    id.repoKey
+  );
+  const repository = options.skipped ? await api.putRepository(id.repoKey) : void 0;
+  if (repository && repository.repo_key !== id.repoKey)
+    throw new CommandError(
+      "The server resolved a different repository; its base status cannot be trusted."
+    );
+  const repositoryId = repository?.repository_id ?? state2?.repositoryId;
+  if (!state2?.viewId || repository && repositoryId !== state2.repositoryId) {
+    const base3 = options.skipped && repositoryId ? await api.getBase(repositoryId, id.commit, true) : void 0;
+    return {
+      state: base3?.state === "failed" ? "failed" : base3?.state === "fetching" ? "fetching" : "not_synced",
+      org_id: policy2.org_id,
+      repo_key: id.repoKey,
+      base_commit: id.commit,
+      ...base3 ? { base: base3 } : {}
+    };
+  }
+  const view2 = await api.getView(state2.viewId);
+  if (view2.repository_id !== state2.repositoryId || view2.view_id !== state2.viewId || view2.view_key !== state2.viewKey)
+    throw new CommandError(
+      "The server view does not match this repository/worktree; its status cannot be trusted."
+    );
+  const overlay = await scanOverlay(id, policy2);
+  const current = view2.active?.base_commit === id.commit && view2.active.overlay_digest === overlay.digest && state2.activated?.baseCommit === view2.active.base_commit && state2.activated.overlayDigest === view2.active.overlay_digest && state2.activated.pendingVersion === view2.active.version && state2.activated.policyDigest === policy2.policy_digest;
+  const base2 = options.skipped && state2.repositoryId ? await api.getBase(state2.repositoryId, id.commit, true) : void 0;
+  return {
+    state: base2?.state === "failed" || view2.pending?.state === "failed" ? "failed" : current ? "current" : view2.pending ? "pending" : "stale",
+    org_id: policy2.org_id,
+    repo_key: id.repoKey,
+    base_commit: id.commit,
+    ...view2,
+    local_overlay_digest: overlay.digest,
+    excluded: overlay.excluded,
+    warnings: overlay.warnings,
+    ...base2 ? { base: base2 } : {}
+  };
+}
+
+// src/core/code/query.ts
+import { z as z2 } from "zod";
+var hash = z2.string().regex(/^[0-9a-f]{64}$/);
+var queryView = z2.object({
+  view_id: z2.string().uuid(),
+  repository_id: z2.string().uuid(),
+  view_key: z2.string().min(1),
+  active: z2.object({ version: z2.number().int().positive(), base_commit: z2.string().regex(/^[0-9a-f]{40}$/), overlay_digest: hash }).passthrough(),
+  pending: z2.object({ version: z2.number().int(), state: z2.string(), progress: z2.object({ done: z2.number().int().nonnegative(), total: z2.number().int().nonnegative() }).nullable().optional() }).passthrough().nullable()
+}).passthrough();
+var envelopeSchema = z2.object({
+  data: z2.unknown(),
+  meta: z2.object({ contract: z2.literal("1.3"), view: queryView, truncation: z2.object({ truncated: z2.boolean() }).passthrough() }).passthrough()
+}).passthrough();
+var citationSchema = z2.object({ path: z2.string().min(1), start_line: z2.number().int().positive(), end_line: z2.number().int().positive(), sha256: hash, version: z2.number().int().positive(), from: z2.enum(["base", "overlay"]), snippet: z2.string().optional() }).passthrough();
+var record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var shell = (text) => "'" + text.replaceAll("'", "'\\''") + "'";
+function fail() {
+  throw new CommandError("The code query API returned an invalid contract 1.3 response; no result was presented.");
+}
+function integer(value, name, min, max) {
+  if (value !== void 0 && (!Number.isSafeInteger(value) || value < min || value > max)) throw new UsageError(`${name} must be an integer from ${min} to ${max}.`);
+}
+function validateQuery(operation, p) {
+  const texts = [p.q, p.symbol, p.kind, p.pathPrefix, ...p.symbols ?? [], ...p.files ?? []];
+  if (texts.some((s) => s !== void 0 && (typeof s !== "string" || s.length === 0 || Buffer.byteLength(s) > 8192 || /[\x00-\x1f\x7f-\x9f]/.test(s) || Buffer.from(s).toString("utf8") !== s))) throw new UsageError("Code query arguments must be nonempty UTF-8 text without control characters (at most 8 KiB each).");
+  if (operation === "search" && !p.q?.trim()) throw new UsageError("usage: harness code search <query>");
+  if (operation === "explain" && !p.symbol) throw new UsageError("usage: harness code explain <symbol-id>");
+  if (operation === "context" && Number(Boolean(p.symbol)) + Number(Boolean(p.q?.trim())) !== 1) throw new UsageError("code context requires exactly one query or --symbol.");
+  if (operation === "affected") {
+    const seeds = (p.symbols?.length ?? 0) + (p.files?.length ?? 0);
+    if (seeds < 1 || seeds > 200) throw new UsageError("code affected needs 1 to 200 --symbol/--file seeds.");
+    if (Buffer.byteLength(JSON.stringify(p)) > 24e4) throw new UsageError("Code affected seeds exceed the request size limit; narrow the selection.");
+  }
+  integer(p.limit, "limit", 1, 100);
+  integer(p.depth, "depth", 1, 6);
+  integer(p.budgetTokens, "budget-tokens", 100, operation === "context" ? 32e3 : 16e3);
+}
+function command(op, p) {
+  const parts = ["harness", "code", op];
+  if (p.q !== void 0) parts.push(shell(p.q));
+  if (op === "explain" && p.symbol) parts.push(shell(p.symbol));
+  else if (p.symbol) parts.push("--symbol", shell(p.symbol));
+  for (const id of p.symbols ?? []) parts.push("--symbol", shell(id));
+  for (const file of p.files ?? []) parts.push("--file", shell(file));
+  for (const [key, value] of [["limit", p.limit], ["depth", p.depth], ["budget-tokens", p.budgetTokens], ["kind", p.kind], ["path-prefix", p.pathPrefix]])
+    if (value !== void 0) parts.push(`--${key}`, typeof value === "number" ? String(value) : shell(value));
+  if (p.includeAmbiguous) parts.push("--include-ambiguous");
+  if (p.includeTypes) parts.push("--include-types");
+  if (p.worktree) parts.push("--path", shell(p.worktree));
+  return named(parts.join(" "));
+}
+function nextCommand(op, p, next) {
+  if (!record(next)) return null;
+  const updated = { ...p };
+  let changed = false;
+  for (const [key, field] of [["limit", "limit"], ["depth", "depth"], ["budget_tokens", "budgetTokens"]]) {
+    if (key === "limit" && op !== "search" || key === "depth" && op !== "affected" || key === "budget_tokens" && op !== "explain" && op !== "context") continue;
+    if (typeof next[key] === "number") {
+      updated[field] = next[key];
+      changed = true;
+    }
+  }
+  if (!changed) return null;
+  try {
+    validateQuery(op, updated);
+  } catch {
+    return null;
+  }
+  return command(op, updated);
+}
+function renderQuery(operation, params, raw) {
+  const parsed = envelopeSchema.safeParse(raw);
+  if (!parsed.success) fail();
+  const response = parsed.data;
+  if (operation === "search" ? !Array.isArray(response.data) : !record(response.data)) fail();
+  const { view: view2, truncation } = response.meta;
+  const guidance = [];
+  const lines = [`View ${view2.view_id}: version ${view2.active.version}; base ${view2.active.base_commit}; overlay ${view2.active.overlay_digest}`];
+  if (view2.pending) lines.push(`Pending version ${view2.pending.version}: ${clean(view2.pending.state)}${view2.pending.progress ? ` (${view2.pending.progress.done}/${view2.pending.progress.total})` : ""}`);
+  let visited = 0;
+  const buckets = {};
+  const walk = (value, label3, depth, enclosingSymbol, countBuckets = true) => {
+    if (++visited > 1e5 || depth > 32) fail();
+    if (record(value)) {
+      const symbol = typeof value["symbol_id"] === "string" ? value["symbol_id"] : enclosingSymbol;
+      if ("path" in value && "start_line" in value && "sha256" in value) {
+        const citation = citationSchema.safeParse(value);
+        if (!citation.success || citation.data.end_line < citation.data.start_line || citation.data.version !== view2.active.version) fail();
+        const c = citation.data;
+        lines.push(`${label3}: ${clean(c.path)}:${c.start_line}${c.end_line === c.start_line ? "" : `-${c.end_line}`}@${c.sha256} [${c.from}, version ${c.version}]`);
+        const context = command("context", { ...symbol || params.symbol ? { symbol: symbol ?? params.symbol } : { q: params.q ?? "symbol name" }, worktree: params.worktree });
+        lines.push(c.snippet !== void 0 ? c.snippet.split("\n").map(clean).join("\n") : `Snippet not supplied; retrieve indexed text: ${context}`);
+        for (const [key, extra] of Object.entries(value)) if (!["path", "start_line", "end_line", "sha256", "version", "from", "snippet"].includes(key)) walk(extra, `${label3}.${clean(key)}`, depth + 1, symbol, countBuckets);
+      } else for (const [key, child] of Object.entries(value)) walk(child, `${label3}.${clean(key)}`, depth + 1, symbol, countBuckets);
+    } else if (Array.isArray(value)) {
+      if (countBuckets && label3 !== "data") buckets[label3.slice(5)] = value.length;
+      if (!value.length) lines.push(`${label3}: []`);
+      value.forEach((v, i) => walk(v, `${label3}[${i}]`, depth + 1, enclosingSymbol, false));
+    } else lines.push(`${label3}: ${clean(typeof value === "string" ? value : JSON.stringify(value))}`);
+  };
+  walk(response.data, "data", 0);
+  const counts = Array.isArray(response.data) ? response.data.length : buckets;
+  const total = typeof truncation["total"] === "number" ? truncation["total"] : response.meta["total"];
+  lines.push(`Truncated: ${truncation.truncated ? "yes" : "no"}; returned: ${JSON.stringify(counts)}; total: ${typeof total === "number" ? total : "unknown (not supplied by server)"}`);
+  if (truncation.truncated) {
+    lines.push(`Truncation metadata: ${JSON.stringify(truncation)}`);
+    const next = nextCommand(operation, params, truncation["next"]);
+    guidance.push(next ? `Next: ${next}` : `Next: narrow the query or use rg -n; ${typeof truncation["hint"] === "string" ? clean(truncation["hint"]) : "the server supplied no larger request."}`);
+  }
+  const coverage = record(response.data) ? response.data["not_tracked"] : void 0;
+  if (Array.isArray(coverage) && coverage.length) {
+    for (const entry of coverage) if (record(entry)) guidance.push(`Coverage${entry["partial"] === true ? " (partial)" : ""}: ${clean(entry["reason"])}`);
+  }
+  if (Array.isArray(coverage) && coverage.length || Array.isArray(response.data) && response.data.length === 0) {
+    const symbol = record(response.data) && record(response.data["symbol"]) ? response.data["symbol"]["name"] : void 0;
+    guidance.push(`Search locally: rg -n --fixed-strings -- ${shell(params.q ?? (typeof symbol === "string" ? symbol : "symbol name"))} .`);
+  }
+  return { json: { ...response, guidance }, human: lines.concat(guidance).join("\n") + "\n" };
+}
+async function queryCode(api, operation, params, options) {
+  validateQuery(operation, params);
+  const id = await identity(options.cwd);
+  const policy2 = await api.getPolicy();
+  if (!z2.string().uuid().safeParse(policy2.org_id).success) fail();
+  const path = statePath(api.origin, policy2.org_id, id.root, id.repoKey, options.stateDir);
+  const state2 = await readState(path, api.origin, policy2.org_id, id.root, id.repoKey);
+  if (!state2?.viewId || !state2.repositoryId) throw new CommandError(`This worktree has no code view. Run harness code sync --path ${shell(id.root)} first.`);
+  const view2 = await api.getView(state2.viewId);
+  const matches = (v) => v.view_id === state2.viewId && v.repository_id === state2.repositoryId && v.view_key === state2.viewKey;
+  if (!matches(view2)) throw new CommandError("The code view does not match this repository/worktree; no query was sent.");
+  if (!view2.active) throw new CommandError(`The view has no indexed version yet. Check harness code status --path ${shell(id.root)} until indexing finishes.`);
+  try {
+    const raw = await api.query(state2.viewId, operation, params);
+    const result = renderQuery(operation, { ...params, worktree: id.root }, raw);
+    if (!matches(result.json.meta.view)) throw new CommandError("The query view does not match this repository/worktree; no result was presented.");
+    return result;
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404 && operation !== "search") throw new CommandError(`The code symbol or view was not found. Search again with ${command("search", { q: "symbol name", worktree: id.root })}; symbol IDs are opaque and can change after edits. Check code status for a removed view.`);
+    throw error;
+  }
+}
+
+// src/commands/code/index.ts
+function enterWorktree(options) {
+  const cwd = process.cwd();
+  const before = statSync(".");
+  const declared = statSync(cwd);
+  if (before.dev !== declared.dev || before.ino !== declared.ino)
+    throw new LocalError("Cannot enter the code worktree safely.");
+  const supplied = options.path ?? cwd;
+  if (/[\x00-\x1f\x7f-\x9f]/.test(supplied) || Buffer.from(supplied, "utf8").toString("utf8") !== supplied || options.path !== void 0 && supplied.includes("\uFFFD"))
+    throw new LocalError("Cannot enter the code worktree safely.");
+  const path = resolve2(supplied);
+  try {
+    const target = statSync(path);
+    if (options.path === void 0 && (before.dev !== target.dev || before.ino !== target.ino))
+      throw new Error("current directory identity changed");
+    process.chdir(path);
+    const entered = statSync(".");
+    if (entered.dev !== target.dev || entered.ino !== target.ino)
+      throw new Error("worktree identity changed");
+  } catch {
+    throw new LocalError("Cannot enter the code worktree; check --path.");
+  }
+  return { ...options, path };
+}
+async function sync(ctx, options = {}) {
+  try {
+    const result = await syncCode(new HttpCodeApi(ctx.config), {
+      cwd: options.path ?? process.cwd(),
+      skipped: options.skipped
+    });
+    return {
+      json: result,
+      exitCode: result.state === "failed" ? 1 : 0,
+      human: `${clean(result.repo_key)}: ${clean(result.state)} version ${result.pending_version}; uploaded ${result.uploaded_blobs} overlay blobs.
+View: ${result.view_id}
+${result.excluded.length} overlay files skipped; ${result.base.excluded_count ?? 0} base files skipped.${options.skipped ? "\n" + (result.base.skipped ?? []).map((s) => `${clean(s.path)}: ${clean(s.reason)}`).join("\n") : ""}
+${result.warnings.map((w) => `Warning: ${clean(w)}
+`).join("")}`
+    };
+  } catch (error) {
+    throw error instanceof HttpError ? describeCodeError(error) : error;
+  }
+}
+async function status2(ctx, options = {}) {
+  try {
+    const result = await statusCode(new HttpCodeApi(ctx.config), {
+      cwd: options.path ?? process.cwd(),
+      skipped: options.skipped
+    });
+    const report = "base" in result ? result.base : void 0;
+    const pending = "pending" in result ? result.pending : null;
+    const serverError = pending?.error ?? report?.error;
+    const failure = serverError && typeof serverError === "object" && "message" in serverError && typeof serverError.message === "string" ? clean(serverError.message) : "";
+    return {
+      json: result,
+      exitCode: result.state === "failed" ? 1 : 0,
+      human: `${clean(result.repo_key)}: ${result.state.replace("_", " ")}${failure ? ": " + failure : ""}
+${report?.skipped?.map((s) => `${clean(s.path)}: ${clean(s.reason)}
+`).join("") ?? ""}${("warnings" in result ? result.warnings : [])?.map((w) => `Warning: ${clean(w)}
+`).join("") ?? ""}`
+    };
+  } catch (error) {
+    throw error instanceof HttpError ? describeCodeError(error) : error;
+  }
+}
+async function query(ctx, operation, params, options = {}) {
+  try {
+    return await queryCode(new HttpCodeApi(ctx.config), operation, params, { cwd: options.path ?? process.cwd() });
+  } catch (error) {
+    throw error instanceof HttpError ? describeCodeError(error) : error;
+  }
+}
+
+// src/cli.ts
+function promptLine(question) {
+  const readline = createInterface({
+    input: process.stdin,
+    output: process.stderr
+  });
+  return new Promise((resolve3) => {
+    readline.question(question, (answer) => {
+      readline.close();
+      resolve3(answer);
+    });
+  });
+}
+function exitWith(code2) {
+  const drain = (stream) => new Promise((resolve3) => stream.write("", () => resolve3()));
+  return Promise.all([drain(process.stdout), drain(process.stderr)]).then(
+    () => process.exit(code2)
+  );
+}
+guardBrokenPipes();
+var program = new Command();
+var invokedAs = invokedName();
+function writeStderr(text) {
+  return process.stderr.write(named(text, invokedAs));
+}
+program.name(invokedAs).description(
+  invokedAs === "operator" ? "drive Operator from the terminal and any agent, with Harness issue tracking alongside (harness.infra.one)" : "issue tracking for humans and agents (harness.infra.one)"
+).exitOverride().configureOutput({
+  writeOut: (text) => process.stdout.write(named(text, invokedAs)),
+  writeErr: (text) => writeStderr(text)
+});
+function integer2(value) {
+  if (!/^\d+$/.test(value))
+    throw new InvalidArgumentError("expected a non-negative integer");
+  return Number.parseInt(value, 10);
+}
+function activityLimit(value) {
+  const limit = integer2(value);
+  if (limit < 1 || limit > ACTIVITY_MAX_LIMIT) {
+    throw new InvalidArgumentError(
+      `expected an integer from 1 to ${ACTIVITY_MAX_LIMIT}`
+    );
+  }
+  return limit;
+}
+function collect(value, previous) {
+  return [...previous, value];
+}
+function resolvedCommentBody(text, bodyFile, action = "post") {
+  if (bodyFile !== void 0 && text.length > 0) {
+    throw new UsageError(
+      "comment text and --body-file both given \u2014 pass one; there is no precedence between them"
+    );
+  }
+  const fromFile = resolveTextSources([
+    { name: "body", inline: void 0, file: bodyFile }
+  ]).body;
+  const body = fromFile === void 0 ? text : [fromFile];
+  if (body.join(" ").trim() === "") {
+    throw new UsageError(
+      bodyFile === void 0 ? `the comment text is empty \u2014 nothing to ${action}` : `--body-file ${bodyFile} produced an empty comment \u2014 nothing to ${action}`
+    );
+  }
+  return body;
+}
+var requireIdentifiers2 = requireIdentifiers;
+function interactive() {
+  const ci = process.env["CI"];
+  return process.stdout.isTTY === true && (ci === void 0 || ci === "");
+}
+function canConfirmRepoLogin() {
+  return process.stdin.isTTY === true && process.stderr.isTTY === true;
+}
+async function confirmRepoLogin(baseUrl, source, path) {
+  if (source !== "repo-config" || isHostTrusted(baseUrl)) return true;
+  const answer = await promptLine(
+    `This repo's config (${path ?? ".harness-cli/config.json"}) targets ${baseUrl} \u2014 log in there? [y/N] `
+  );
+  if (answer.trim().toLowerCase() !== "y") {
+    writeStderr(`harness: not logging in to ${baseUrl} \u2014 set HARNESS_API_URL to override the repo config
+`);
+    return false;
+  }
+  trustHost(baseUrl);
+  return true;
+}
+async function withConfig(jsonFlag, mutating, run3) {
+  const resolved = resolveConfig();
+  for (const warning of resolved.warnings) writeStderr(warning + "\n");
+  if (resolved.kind === "error") {
+    writeStderr(`harness: ${resolved.message}
+`);
+    return exitWith(2);
+  }
+  if (resolved.kind === "needs-login") {
+    if (!interactive()) {
+      writeStderr(loginHelp(resolved.baseUrl));
+      if (resolved.org !== void 0) writeStderr(`Choose organization ${resolved.org} when logging in.
+`);
+      return exitWith(2);
+    }
+    if (!await confirmRepoLogin(resolved.baseUrl, resolved.hostSource, resolved.repoConfigPath)) {
+      return exitWith(2);
+    }
+    const loginResult = await login(resolved.baseUrl, resolved.org === void 0 ? {} : { org: resolved.org });
+    if (!loginResult.ok) {
+      writeStderr(`harness: ${clean(loginResult.message)}
+`);
+      return exitWith(1);
+    }
+    writeStderr(loginResult.human);
+    const again = resolveConfig();
+    if (again.kind !== "ok") {
+      writeStderr(
+        `harness: still not signed in to ${resolved.baseUrl} after logging in
+`
+      );
+      return exitWith(1);
+    }
+    return execute(again.config, jsonFlag, mutating, run3);
+  }
+  return execute(resolved.config, jsonFlag, mutating, run3);
+}
+async function execute(config, jsonFlag, mutating, run3) {
+  const client = new Client(config);
+  const hostNotice = mutating ? `\u2192 ${config.baseUrl}
+` : "";
+  try {
+    const output = await run3({ client, config });
+    writeStderr(hostNotice);
+    if (output.notice !== void 0) writeStderr(output.notice);
+    process.stdout.write(jsonFlag ? json(output.json) : output.human);
+    return exitWith(output.exitCode ?? (output.partial === true ? 1 : 0));
+  } catch (error) {
+    return fail2(explainExpertRefusal(error, config.token), hostNotice);
+  }
+}
+async function fail2(error, hostNotice) {
+  if (error instanceof UsageError) {
+    writeStderr(error.message + "\n");
+    return exitWith(2);
+  }
+  if (error instanceof LocalError) {
+    writeStderr(`harness: ${clean(error.message)}
+`);
+    return exitWith(1);
+  }
+  if (error instanceof TransportError) {
+    writeStderr(
+      hostNotice + `harness: cannot reach the API: ${clean(error.message)}
+`
+    );
+    return exitWith(3);
+  }
+  if (error instanceof UpgradeRequiredError) {
+    const healed = selfHeal();
+    if (healed.kind === "upgraded") return exitWith(healed.code);
+    const why = healed.kind === "failed" ? ` (tried to upgrade: ${clean(healed.reason)})` : "";
+    writeStderr(
+      hostNotice + `harness: ${clean(error.message)} (HTTP 426)${why}
+`
+    );
+    return exitWith(1);
+  }
+  if (error instanceof HttpError) {
+    writeStderr(
+      hostNotice + `harness: ${clean(error.message)} (HTTP ${error.status})${errorDetails(error.body)}
+`
+    );
+    return exitWith(1);
+  }
+  if (error instanceof CommandError) {
+    writeStderr(hostNotice + `harness: ${clean(error.message)}
+`);
+    return exitWith(1);
+  }
+  throw error;
+}
+program.command("ready").description("issues ready to work, highest priority first").option(
+  "--claim",
+  "claim the team's next ready, unassigned issue in one server-side request (team from --team, HARNESS_TEAM or the repo config; no paging flags)"
+).option("--team <key>", "team filter; with --claim, the team to claim from").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  if (opts.claim === true) requireReadyClaimArgs(opts);
+  await withConfig(
+    opts.json === true,
+    opts.claim === true,
+    (ctx) => ready(ctx, opts)
+  );
+});
+program.command("blocked").description("issues waiting on a blocker").option("--team <key>", "team filter").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => blocked(ctx, opts)
+  );
+});
+program.command("list").description("list issues with filters").option("--status <status>", "open | in_progress | closed").option(
+  "--assignee <who>",
+  'me, a user id, an email, or a full name; "" for unassigned'
+).option("--created-by <who>", "me or a creator user id").option(
+  "--involved <who>",
+  "me for issues created by, assigned to, or mentioning you"
+).option("--priority <name>", "urgent | high | medium | low | none").option("--label <name>", "label filter").option("--type <type>", "task | bug | feature | epic").option("--search <query>", "full-text search").option("--team <key>", "team filter").option("--parent <id>", "children of an epic").option("--scope <scope>", "all | archived").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => list(ctx, opts)
+  );
+});
+program.command("search").description(
+  "search by meaning \u2014 ranked, exact identifier first; use list --search for paginated filtering"
+).argument("[query...]").option("--limit <n>", "maximum results (default 10, capped at 20)", integer2).option(
+  "--page <n>",
+  "(deprecated, ignored \u2014 results are ranked and capped)",
+  integer2
+).option("--all", "(deprecated, ignored \u2014 results are ranked and capped)").option("--json", "emit JSON").action(
+  async (query2, opts) => {
+    await withConfig(
+      opts.json === true,
+      false,
+      (ctx) => search(ctx, query2, opts)
+    );
+  }
+);
+program.command("show").description("full issue detail; downloads attached images locally").argument("[id]").option("--no-images", "skip attachment downloads").option("--json", "emit JSON").action(
+  async (id, opts) => {
+    await withConfig(opts.json === true, false, (ctx) => {
+      if (id === void 0) throw new UsageError("usage: harness show <id>");
+      requireIdentifiers2([id]);
+      return show(ctx, id, opts);
+    });
+  }
+);
+program.command("activity").description("mixed issue activity: comments, creation, state, assignee, wait-condition and field changes").argument("[id]").option(
+  "--limit <n>",
+  `entries per page (default 20, max ${ACTIVITY_MAX_LIMIT})`,
+  activityLimit
+).option("--all", "read all older activity").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (id === void 0) throw new UsageError("usage: harness activity <id>");
+    requireIdentifiers2([id]);
+    return activity(ctx, id, opts);
+  });
+});
+program.command("stats").description("per-team and total counts").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => stats(ctx));
+});
+program.command("prime").description("workflow context for agent sessions: stats + ready queue").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => prime(ctx));
+});
+program.command("version").description("print CLI and server API versions").option("--json", "emit JSON").action(async (opts) => {
+  const resolved = resolveConfig();
+  let config = null;
+  if (resolved.kind === "ok") config = resolved.config;
+  else if (resolved.kind === "needs-login") {
+    config = {
+      baseUrl: resolved.baseUrl,
+      token: "",
+      actor: null,
+      team: null,
+      cacheDir: ""
+    };
+  }
+  const output = await version(config);
+  process.stdout.write(
+    opts.json === true ? json(output.json) : output.human
+  );
+  await exitWith(0);
+});
+function issueTextSources(opts) {
+  return [
+    { name: "title", inline: opts.title, file: opts.titleFile },
+    { name: "description", inline: opts.description, file: opts.descriptionFile },
+    { name: "design", inline: opts.design, file: opts.designFile },
+    { name: "notes", inline: opts.notes, file: opts.notesFile },
+    { name: "acceptance", inline: opts.acceptance, file: opts.acceptanceFile }
+  ];
+}
+function requireNonBlankInlineTitle(title) {
+  if (title !== void 0 && title.trim() === "") {
+    throw new UsageError("--title is empty \u2014 an issue needs a title");
+  }
+}
+function requireNonBlankTitle(text, titleFile) {
+  if ((text["title"] ?? "").trim() !== "") return;
+  throw new UsageError(
+    titleFile === void 0 ? "--title is empty \u2014 an issue needs a title" : `--title-file ${titleFile} produced an empty title`
+  );
+}
+program.command("create").description("create an issue atomically after resolving requested labels").option("--title <text>", "issue title (required)").option("--description <text>", "problem statement").option("--design <text>", "design notes").option("--notes <text>", "working notes").option("--acceptance <text>", "acceptance criteria").option("--title-file <path>", 'read the title from a file ("-" for stdin)').option("--description-file <path>", 'read the description from a file ("-" for stdin)').option("--design-file <path>", 'read the design notes from a file ("-" for stdin)').option("--notes-file <path>", 'read the notes from a file ("-" for stdin)').option("--acceptance-file <path>", 'read the acceptance criteria from a file ("-" for stdin)').option(
+  "--type <type>",
+  "task | bug | feature | epic (applied as a type/ label)"
+).option("--priority <name>", "urgent | high | medium | low | none").option("--due-date <date>", "YYYY-MM-DD").option("--parent <id>", "parent epic").option("--assignee <who>", "me, a user id, an email, or a full name").option("--team <key>", "team key (or HARNESS_TEAM)").option("--idempotency-key <key>", "reuse the same key when deliberately retrying this create").option(
+  "--label <name>",
+  "resolve team-first, then workspace; create missing workspace labels before the issue (repeatable)",
+  collect,
+  []
+).option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (opts.title === void 0 && opts.titleFile === void 0) {
+      throw new UsageError(
+        "usage: harness create --title <title> | --title-file <path> [--team <key>] \u2026"
+      );
+    }
+    requireNonBlankInlineTitle(opts.title);
+    const text = resolveTextSources(issueTextSources(opts));
+    requireNonBlankTitle(text, opts.titleFile);
+    return create(ctx, { ...opts, ...text });
+  });
+});
+program.command("update").description("update an issue; --claim takes it atomically").argument("[id]").option("--claim", "claim atomically and move to the first started state").option("--state <name>", "workflow state by name or type").option("--title <text>").option("--description <text>").option("--design <text>").option("--notes <text>", "replace the notes").option("--append-notes <text>", "append to the notes").option("--acceptance <text>").option("--title-file <path>", 'read the title from a file ("-" for stdin)').option("--description-file <path>", 'read the description from a file ("-" for stdin)').option("--design-file <path>", 'read the design notes from a file ("-" for stdin)').option("--notes-file <path>", 'replace the notes from a file ("-" for stdin)').option("--append-notes-file <path>", 'append to the notes from a file ("-" for stdin)').option("--acceptance-file <path>", 'read the acceptance criteria from a file ("-" for stdin)').option("--priority <name>", "urgent | high | medium | low | none").option("--due-date <date>", 'YYYY-MM-DD; "" clears').option("--parent <id>").option(
+  "--assignee <who>",
+  'me, a user id, an email, or a full name; "" unassigns'
+).option(
+  "--add-label <name-or-id>",
+  "add a label without replacing existing labels (repeatable)",
+  collect,
+  []
+).option(
+  "--remove-label <name-or-id>",
+  "remove an attached label without replacing others (repeatable)",
+  collect,
+  []
+).option("--json", "emit JSON").action(
+  async (id, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (id === void 0) {
+        throw new UsageError(
+          "usage: harness update <id> --claim | --title \u2026 | --state <name> | \u2026"
+        );
+      }
+      requireIdentifiers2([id]);
+      requireNonBlankInlineTitle(opts.title);
+      const text = resolveTextSources([
+        ...issueTextSources(opts),
+        { name: "appendNotes", inline: opts.appendNotes, file: opts.appendNotesFile }
+      ]);
+      if (Object.hasOwn(text, "title")) requireNonBlankTitle(text, opts.titleFile);
+      return update(ctx, id, { ...opts, ...text });
+    });
+  }
+);
+program.command("close").description("close issues; the response lists newly unblocked issues").argument("[ids...]").option("--reason <text>", "why it is done (e.g. the commit hash)").option("--reason-file <path>", 'read the reason from a file ("-" for stdin)').option("--cancel", "close as canceled instead of completed").option("--duplicate-of <id>", "close one issue as a duplicate of the canonical issue").option("--json", "emit JSON").action(
+  async (ids, opts) => {
+    if (ids.length === 0) {
+      throw new UsageError(
+        "usage: harness close <id> [<id>\u2026] [--reason <text> | --reason-file <path>] [--cancel | --duplicate-of <id>]"
+      );
+    }
+    requireCloseArgs(ids, opts);
+    await withConfig(opts.json === true, true, (ctx) => {
+      const text = resolveTextSources([
+        { name: "reason", inline: opts.reason, file: opts.reasonFile }
+      ]);
+      if (Object.hasOwn(text, "reason") && (text["reason"] ?? "").trim() === "") {
+        throw new UsageError(
+          opts.reasonFile === void 0 ? "--reason is empty \u2014 omit it, or give a reason" : `--reason-file ${opts.reasonFile} produced an empty reason`
+        );
+      }
+      return close(ctx, ids, { ...opts, ...text });
+    });
+  }
+);
+program.command("archive").description("archive issues; --restore brings them back").argument("[ids...]").option("--restore", "restore instead of archive").option("--json", "emit JSON").action(
+  async (ids, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (ids.length === 0)
+        throw new UsageError(
+          "usage: harness archive <id> [<id>\u2026] [--restore]"
+        );
+      requireIdentifiers2(ids);
+      return archive(ctx, ids, opts);
+    });
+  }
+);
+program.command("comments").description("an issue's full comment thread, untruncated").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (id === void 0)
+      throw new UsageError("usage: harness comments <id>");
+    requireIdentifiers2([id]);
+    return comments(ctx, id);
+  });
+});
+program.command("dep").description("blocking dependencies: dep add|rm <issue> <blocker>").argument("[verb]").argument("[issue]").argument("[blocker]").option("--json", "emit JSON").action(
+  async (verb, issue, blocker, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (verb === void 0 || issue === void 0 || blocker === void 0) {
+        throw new UsageError("usage: harness dep add|rm <issue> <blocker>");
+      }
+      requireIdentifiers2([issue, blocker]);
+      return dep(ctx, verb, issue, blocker);
+    });
+  }
+);
+var relation = program.command("relation").description("typed issue relations; dep remains the blocking-dependency shorthand");
+relation.command("list").argument("[issue]").option("--json", "emit JSON").action(async (issue, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (issue === void 0) throw new UsageError("usage: harness relation list <issue>");
+    return relationList(ctx, issue);
+  });
+});
+relation.command("add").argument("[issue]").argument("[related-issue]").requiredOption("--type <type>", `relation type: ${RELATION_CREATE_TYPES.join(", ")}`).option("--json", "emit JSON").action(
+  async (issue, relatedIssue, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (issue === void 0 || relatedIssue === void 0) {
+        throw new UsageError("usage: harness relation add <issue> <related-issue> --type <type>");
+      }
+      return relationAdd(ctx, issue, relatedIssue, opts.type);
+    });
+  }
+);
+relation.command("update").argument("[issue]").argument("[id-or-issue]").requiredOption("--type <type>", `relation type: ${RELATION_UPDATE_TYPES.join(", ")}`).option("--json", "emit JSON").action(
+  async (issue, idOrIssue, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (issue === void 0 || idOrIssue === void 0) {
+        throw new UsageError("usage: harness relation update <issue> <relation-id-or-issue> --type <type>");
+      }
+      return relationUpdate(ctx, issue, idOrIssue, opts.type);
+    });
+  }
+);
+relation.command("rm").argument("[issue]").argument("[id-or-issue]").option("--json", "emit JSON").action(async (issue, idOrIssue, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (issue === void 0 || idOrIssue === void 0) {
+      throw new UsageError("usage: harness relation rm <issue> <relation-id-or-issue>");
+    }
+    return relationRm(ctx, issue, idOrIssue);
+  });
+});
+var plan = program.command("plan").description("plans: a whole graph of issues created in one request, then released and held");
+plan.command("create").description("create a plan from a JSON or YAML file (the API's request body); it starts held").option("--file <path>", 'the plan: .json is JSON, anything else YAML ("-" for stdin)').option("--team <key>", "team of the root and of people's steps (or HARNESS_TEAM)").option("--idempotency-key <key>", "reuse the same key when deliberately retrying this create").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (opts.file === void 0) {
+      throw new UsageError("usage: harness plan create --file <plan.json|plan.yaml> [--team <key>]");
+    }
+    const team2 = requiredTeam(ctx, opts.team);
+    validateIdempotencyKey(opts.idempotencyKey);
+    return planCreate(ctx, readPlanFile(opts.file), { ...opts, team: team2 });
+  });
+});
+plan.command("list").description("a team's plans, newest first: root, status, held, revision and title").option("--team <key>", "the team whose issues root the plans (or HARNESS_TEAM)").option("--status <status>", PLAN_STATUSES.join(" | ")).option("--limit <n>", `maximum plans (default 50, at most ${PLAN_LIST_MAX_LIMIT}; there are no pages)`, integer2).option("--json", "emit JSON").action(async (opts) => {
+  requirePlanListArgs(opts);
+  await withConfig(opts.json === true, false, (ctx) => planList(ctx, opts));
+});
+var PLAN_ARGUMENT = "the plan's id, or its root issue's identifier (e.g. FR-1)";
+plan.command("show").description("a plan's status, budgets, revision, steps, edges and wait conditions").argument("[plan]", PLAN_ARGUMENT).option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (id === void 0) throw new UsageError("usage: harness plan show <plan-id-or-root>");
+    return planShow(ctx, id);
+  });
+});
+plan.command("edit").description("change step executors and keys, and budgets, from a JSON or YAML file").argument("[plan]", PLAN_ARGUMENT).option("--file <path>", 'the edit: .json is JSON, anything else YAML ("-" for stdin)').option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (id === void 0 || opts.file === void 0) {
+      throw new UsageError("usage: harness plan edit <plan-id-or-root> --file <edits.json|edits.yaml>");
+    }
+    requirePlanRef(id);
+    return planEdit(ctx, id, readPlanFile(opts.file));
+  });
+});
+plan.command("release").description("release a plan as yourself: freeze its next revision and let its ready steps run").argument("[plan]", PLAN_ARGUMENT).option("--collaborator <who>", "a person of this organization (id or email) for the plan room (repeatable)", collect, []).option("--retry-budget <n>", "retries per failed Operator step", integer2).option("--spend-budget-cents <n>", "the plan's spend budget; needed to release Operator steps", integer2).option("--json", "emit JSON").action(
+  async (id, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (id === void 0) throw new UsageError("usage: harness plan release <plan-id-or-root>");
+      return planRelease(ctx, id, { ...opts, collaborators: opts.collaborator });
+    });
+  }
+);
+plan.command("hold").description("pause every step of a plan until it is released again").argument("[plan]", PLAN_ARGUMENT).option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (id === void 0) throw new UsageError("usage: harness plan hold <plan-id-or-root>");
+    return planHold(ctx, id);
+  });
+});
+var gate = program.command("gate").description("manual wait conditions: gate satisfy|unsatisfy <issue> <gate>");
+for (const [verb, satisfied] of [
+  ["satisfy", true],
+  ["unsatisfy", false]
+]) {
+  gate.command(verb).description(`${satisfied ? "tick" : "untick"} a gate on an issue, by its key, label or condition id`).argument("[issue]").argument("[gate]").option("--json", "emit JSON").action(async (issue, gateName, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (issue === void 0 || gateName === void 0) {
+        throw new UsageError(`usage: harness gate ${verb} <issue> <gate-key-label-or-id>`);
+      }
+      return gateSet(ctx, issue, gateName, satisfied);
+    });
+  });
+}
+program.command("conditions").description("an issue's wait conditions; with an outside expert's pxc_ credential, the gates they own on it").argument("[issue]").option("--json", "emit JSON").action(async (issue, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (issue === void 0) throw new UsageError("usage: harness conditions <issue>");
+    return conditionList(ctx, issue);
+  });
+});
+program.command("assignments").description("an outside expert's steps and the gates they own on them (pxc_ credentials only)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => assignments(ctx));
+});
+var NO_OBJECTIVE_TEXT = "By reference only: never the objective's text, which the API does not return because it can quote what Operator read; the workbench link opens it. Approval happens in the app.";
+program.command("jobs").description("Operator jobs you see in the workbench, newest first").option(
+  "--status <states>",
+  `comma-separated job states (${JOB_STATES.join(", ")}) or open | waiting | done`
+).option("--mine", "only jobs you own").option(`--limit <n>`, `jobs per page (default 20, max ${JOBS_MAX_LIMIT})`, integer2).option("--all", `follow every page (up to ${JOBS_MAX_PAGES})`).option("--json", "emit JSON").addHelpText("after", `
+${NO_OBJECTIVE_TEXT}
+`).action(async (opts) => {
+  requireJobsArgs(opts);
+  await withConfig(opts.json === true, false, (ctx) => jobsList(ctx, opts));
+});
+program.command("job").description("one Operator job: status, plan, progress, window, spend, approval link, effects, artifacts, people").argument("[id]").option("--changes", "instead, its change set by reference (never values or targets), with the approval link").option("--people", "instead, who is on it by name: requester, execution principal, owner, approvers, collaborators").option("--json", "emit JSON").addHelpText("after", `
+${NO_OBJECTIVE_TEXT}
+`).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness job <job-id> [--changes] [--people]");
+  requireJobId(id);
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => jobShow(ctx, id, { changes: opts.changes, people: opts.people })
+  );
+});
+program.command("watch").description("follow an Operator job until it completes, fails, or waits for a person").argument("[id]").option("--after <seq>", "start after this event sequence (default 0: the whole history)", integer2).option("--through-waits", "keep following while a person has to act, instead of stopping").option("--json", "emit one JSON document when the watch ends").addHelpText(
+  "after",
+  `
+Polls the job's events every 2 s, and every 10 s while the job is paused or
+a person has to act. A person has to act exactly when the job's waiting_on is
+set: an approval, a person, reconciliation, verification or delivery. A job
+paused with nothing for a person to do resumes by itself, so watch follows it.
+It only reads: approval happens in the app, and the approval link is printed.
+A failed poll is retried 3 times (1, 2, 4 s, or the server's Retry-After).
+
+Exit codes:
+  0    the job completed (or stdout's reader went away, e.g. | head)
+  ${EXIT_WAITING_FOR_PERSON}    a person has to act (not with --through-waits); the link is printed
+  ${EXIT_JOB_ENDED}    the job failed or was cancelled
+  ${EXIT_INTERRUPTED}  interrupted with Ctrl-C; stderr says where to resume (--after)
+  1, 3 as for every command: an API error, or the API unreachable after the retries;
+       stderr says where to resume, and --json still prints the events read so far
+  2    a usage error
+`
+).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness watch <job-id>");
+  requireJobId(id);
+  const json2 = opts.json === true;
+  await withConfig(
+    json2,
+    false,
+    (ctx) => jobWatch(ctx, id, {
+      after: opts.after,
+      throughWaits: opts.throughWaits === true,
+      collectEvents: json2,
+      onLine: json2 ? void 0 : (line) => process.stdout.write(line),
+      signal: watchStopSignal()
+    })
+  );
+});
+var NOT_RETRIED = `
+Not idempotent, so it is never retried, not even after a timeout or a server
+error. When a failure leaves the outcome unknown it says so and exits 1:
+check \`job <id>\` before trying again. Exit 3 means the request never
+reached the server, so nothing changed. It answers the job as \`job\` shows
+it. Approving stays in the app.
+`;
+program.command("steer").description("post an instruction to an Operator job, as Steer does in the app; earlier approvals stop applying").argument("[id]").argument("[instruction...]").option("--instruction-file <path>", 'read the instruction from a file ("-" for stdin)').option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Posts the instruction in the job's room, attributed to you, wherever the app
+offers Steer; the job's owner and collaborators may steer. Work it changes
+needs a fresh approval, and a running job stops its current run to take it.
+At most ${STEER_MAX_CHARACTERS} characters once trimmed.
+
+Quote the instruction: unquoted words that look like options (--json, --help)
+are read as options, not text. Put -- before an instruction that starts with
+"-", or pass it with --instruction-file, which takes any text as it is.
+${NOT_RETRIED}`
+).action(async (id, words, opts) => {
+  if (id === void 0 || words.length === 0 && opts.instructionFile === void 0) {
+    throw new UsageError(
+      "usage: harness steer <job-id> <instruction> | harness steer <job-id> --instruction-file <path>"
+    );
+  }
+  requireJobId(id);
+  const instruction = instructionFrom(words, opts.instructionFile);
+  await withConfig(opts.json === true, true, (ctx) => jobSteer(ctx, id, instruction));
+});
+program.command("cancel").description("cancel an Operator job; committed effects stay committed, and their counts are printed").argument("[id]").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Ends the job, as Cancel does in the app; only its execution principal may.
+Staged effects that never ran count as unknown.
+${NOT_RETRIED}`
+).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness cancel <job-id>");
+  requireJobId(id);
+  await withConfig(opts.json === true, true, (ctx) => jobCancel(ctx, id));
+});
+program.command("pause").description("pause a running Operator job for a person, keeping its active-time budget").argument("[id]").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Holds the job, as Pause does in the app; only its execution principal may.
+Continue it to run again.
+${NOT_RETRIED}`
+).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness pause <job-id>");
+  requireJobId(id);
+  await withConfig(opts.json === true, true, (ctx) => jobPause(ctx, id));
+});
+var NOT_IDEMPOTENT = "Not idempotent: it is sent once and never retried, not after a timeout or a 5xx either. Exit 3 means the request never reached the server, so nothing changed. When it may have, the outcome is unknown: it exits 1 and says so. Then check";
+program.command("run").description("start an Operator job from an outcome, as Run as job does in the app; --watch follows it").argument("[outcome...]").option("--budget <usd>", "US dollars the organization's monthly Operator budget must still have (admins only)", once("--budget")).option("--skill <name>", "run one of the organization's Operator skills, by invocation name (/name)", once("--skill")).option("--watch", "follow the job like `watch --through-waits`; it never approves").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Starts a job for you in a new org chat of yours, under your own current rights.
+Prints the job id, its state and its workbench link, and the approval link
+while a change set waits for approval. Approving happens in the app; the CLI
+never approves. You can start 30 jobs an hour. ${NOT_IDEMPOTENT} \`jobs --mine\` for the new job before running it again.
+
+With --watch the job is followed until it completes (exit 0) or fails or is
+cancelled (exit ${EXIT_JOB_ENDED}). When it waits for a person, the approval link is printed and the
+watch keeps waiting; Ctrl-C stops it (exit ${EXIT_INTERRUPTED}) and stderr says how to resume.
+`
+).action(async (words, opts) => {
+  const request = prepareRun(words.join(" "), { budget: opts.budget, skill: opts.skill });
+  const json2 = opts.json === true;
+  await withConfig(
+    json2,
+    true,
+    (ctx) => run(ctx, request, {
+      watch: opts.watch === true,
+      json: json2,
+      onLine: (line) => process.stdout.write(line),
+      signal: opts.watch === true ? watchStopSignal() : void 0
+    })
+  );
+});
+function once(flag) {
+  return (value, previous) => {
+    if (previous !== void 0) throw new InvalidArgumentError(`${flag} given twice \u2014 pass it once`);
+    return value;
+  };
+}
+program.command("continue").description(
+  "open a new audited window for an Operator job that ran out of time or waits on a person, as Continue does in the app"
+).argument("[id]").option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Only the job's execution principal, the person it runs as, may continue it. ${NOT_IDEMPOTENT} \`job <id>\` before continuing it again.
+`
+).action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness continue <job-id>");
+  requireJobId(id);
+  await withConfig(opts.json === true, true, (ctx) => jobContinue(ctx, id));
+});
+var procedure = program.command("procedure").description("saved Operator procedures: procedure save|show|run");
+procedure.command("save").description("save a completed, verified job as a procedure, as Save procedure does in the app (its owner only)").argument("[job-id]").option("--name <name>", "the procedure's name (trimmed, at most 200 characters)", once("--name")).option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Saving again saves another procedure. ${NOT_IDEMPOTENT} the job's procedures (\`job <id>\`) before saving it again.
+`
+).action(async (jobId, opts) => {
+  if (jobId === void 0) throw new UsageError('usage: harness procedure save <job-id> --name "\u2026"');
+  requireJobId(jobId);
+  const name = requireProcedureName(opts.name);
+  await withConfig(opts.json === true, true, (ctx) => procedureSave(ctx, jobId, name));
+});
+procedure.command("show").description("one procedure: its source job, versions (digest, capabilities, actions) and the parameters a run takes").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness procedure show <procedure-id>");
+  requireProcedureId(id);
+  await withConfig(opts.json === true, false, (ctx) => procedureShow(ctx, id));
+});
+procedure.command("run").description("run a procedure as a new job, with fresh inputs, your current rights and an approval of its own in the app").argument("[id]").option("--version <n>", "the version expected to be current (default: whichever is current)", once("--version")).option("--param <name=value>", "a parameter, as a string; name:=<json> for a JSON value (repeatable)", collect, []).option("--params-file <path>", 'the parameters as one JSON object ("-" for stdin)', once("--params-file")).option("--group <id>", "the contact group to reconcile, when the procedure needs one", once("--group")).option("--source <id>", "the uploaded file to reconcile against, when the procedure needs one", once("--source")).option("--json", "emit JSON").addHelpText(
+  "after",
+  `
+Nothing of the saved job carries over: no grant, approval, delegation, collaborator or read material. Approving happens in the app. ${NOT_IDEMPOTENT} \`jobs\` for the new job before running it again.
+`
+).action(
+  async (id, opts) => {
+    if (id === void 0) {
+      throw new UsageError("usage: harness procedure run <procedure-id> [--version N] [--param name=value]\u2026");
+    }
+    const request = prepareProcedureRun(id, {
+      version: opts.version,
+      param: opts.param,
+      paramsFile: opts.paramsFile,
+      group: opts.group,
+      source: opts.source
+    });
+    await withConfig(opts.json === true, true, (ctx) => startProcedureRun(ctx, request));
+  }
+);
+var commentCommand = program.command("comment").description("comment on an issue").argument("[id]").argument("[text...]").option("--body-file <path>", 'read the comment body from a file ("-" for stdin)').option("--mention <name>", "notify a person (repeatable)", collect, []).option("--json", "emit JSON").action(
+  async (id, text, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (id === void 0 || opts.bodyFile === void 0 && text.length === 0) {
+        throw new UsageError(
+          "usage: harness comment <id> <text> [--mention NAME]\u2026 | harness comment <id> --body-file <path>"
+        );
+      }
+      requireIdentifiers2([id]);
+      const body = resolvedCommentBody(text, opts.bodyFile);
+      const mentions = opts.mention.filter((name) => name.trim() !== "");
+      return comment(ctx, id, body, mentions);
+    });
+  }
+);
+commentCommand.command("edit").description("edit one of your issue comments").argument("[issue]").argument("[comment-id]").argument("[text...]").option("--body-file <path>", 'read the replacement body from a file ("-" for stdin)').option("--json", "emit JSON").action(
+  async (issue, commentId, text, opts) => {
+    const parentOpts = commentCommand.opts();
+    const bodyFile = opts.bodyFile ?? parentOpts.bodyFile;
+    await withConfig(opts.json === true || parentOpts.json === true, true, (ctx) => {
+      if (issue === void 0 || commentId === void 0 || bodyFile === void 0 && text.length === 0) {
+        throw new UsageError(
+          "usage: harness comment edit <issue> <comment-id> <text> | harness comment edit <issue> <comment-id> --body-file <path>"
+        );
+      }
+      requireIdentifiers2([issue]);
+      requireCommentId(commentId);
+      return editComment(ctx, issue, commentId, resolvedCommentBody(text, bodyFile, "edit"));
+    });
+  }
+);
+commentCommand.command("delete").alias("rm").description("delete one of your issue comments").argument("[issue]").argument("[comment-id]").option("--json", "emit JSON").action(async (issue, commentId, opts) => {
+  const parentOpts = commentCommand.opts();
+  await withConfig(opts.json === true || parentOpts.json === true, true, (ctx) => {
+    if (issue === void 0 || commentId === void 0) {
+      throw new UsageError("usage: harness comment delete <issue> <comment-id>");
+    }
+    requireIdentifiers2([issue]);
+    requireCommentId(commentId);
+    return deleteComment(ctx, issue, commentId);
+  });
+});
+program.command("attach-image").description("upload an image; prints markdown to reference it").argument("[path]").option("--json", "emit JSON").action(async (path, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (path === void 0) {
+      throw new UsageError(
+        "usage: harness attach-image <path>  (one png, jpg, webp or gif, up to 25 MB)"
+      );
+    }
+    return attachImage(ctx, path);
+  });
+});
+var project = program.command("project").description("projects");
+project.command("list").option("--search <query>", "full-text search").option("--state <state>", "project state filter").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => projectList(ctx, opts)
+  );
+});
+project.command("show").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (id === void 0)
+      throw new UsageError("usage: harness project show <id>");
+    return projectShow(ctx, id);
+  });
+});
+project.command("create").option("--name <name>", "project name (required)").option("--description <text>").option("--summary <text>").option("--state <state>").option("--lead <user-id>", "lead by user id").option("--start-date <date>", "YYYY-MM-DD").option("--target-date <date>", "YYYY-MM-DD").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    true,
+    (ctx) => projectCreate(ctx, opts)
+  );
+});
+project.command("update").argument("[id]").option("--name <name>").option("--description <text>").option("--summary <text>").option("--state <state>").option("--lead <user-id>", "lead by user id").option("--start-date <date>", 'YYYY-MM-DD; "" clears').option("--target-date <date>", 'YYYY-MM-DD; "" clears').option("--json", "emit JSON").action(
+  async (id, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (id === void 0)
+        throw new UsageError(
+          "usage: harness project update <id> --name \u2026 | --state \u2026 | \u2026"
+        );
+      return projectUpdate(ctx, id, opts);
+    });
+  }
+);
+var milestone = program.command("milestone").description("project milestones");
+milestone.command("list").option("--project <id>", "project id (required)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => milestoneList(ctx, opts.project)
+  );
+});
+milestone.command("create").option("--project <id>", "project id (required)").option("--name <name>", "milestone name (required)").option("--description <text>").option("--target-date <date>", "YYYY-MM-DD").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    true,
+    (ctx) => milestoneCreate(ctx, opts)
+  );
+});
+var doc = program.command("doc").description("documents");
+doc.command("list").option("--search <query>", "full-text search").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => docList(ctx, opts)
+  );
+});
+doc.command("show").argument("[id]").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (id === void 0)
+      throw new UsageError("usage: harness doc show <id>");
+    return docShow(ctx, id);
+  });
+});
+doc.command("create").option("--title <title>", "document title (required)").option("--content <text>").option("--project <id>", "attach to a project").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    true,
+    (ctx) => docCreate(ctx, opts)
+  );
+});
+doc.command("update").argument("[id]").option("--title <title>").option("--content <text>").option("--project <id>").option("--json", "emit JSON").action(
+  async (id, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (id === void 0)
+        throw new UsageError(
+          "usage: harness doc update <id> --title \u2026 | --content \u2026 | --project \u2026"
+        );
+      return docUpdate(ctx, id, opts);
+    });
+  }
+);
+var link = program.command("link").description("URLs attached to an issue (distinct from dep relations)");
+link.command("list").argument("[issue]").option("--json", "emit JSON").action(async (issue, opts) => {
+  await withConfig(opts.json === true, false, (ctx) => {
+    if (issue === void 0)
+      throw new UsageError("usage: harness link list <issue>");
+    requireIdentifiers2([issue]);
+    return linkList(ctx, issue);
+  });
+});
+link.command("add").argument("[issue]").argument("[url]").option("--title <title>", "link title").option("--json", "emit JSON").action(
+  async (issue, url, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (issue === void 0 || url === void 0) {
+        throw new UsageError(
+          "usage: harness link add <issue> <url> [--title <title>]"
+        );
+      }
+      requireIdentifiers2([issue]);
+      return linkAdd(ctx, issue, url, opts.title);
+    });
+  }
+);
+link.command("update").argument("[issue]").argument("[id-or-url]").option("--url <url>", "replacement URL").option("--title <title>", "replacement title; pass an empty value to clear").option("--json", "emit JSON").action(
+  async (issue, idOrUrl, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (issue === void 0 || idOrUrl === void 0) {
+        throw new UsageError(
+          "usage: harness link update <issue> <link-id-or-url> --url <url> | --title <title>"
+        );
+      }
+      return linkUpdate(ctx, issue, idOrUrl, opts);
+    });
+  }
+);
+link.command("rm").argument("[issue]").argument("[id-or-url]").option("--json", "emit JSON").action(
+  async (issue, idOrUrl, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => {
+      if (issue === void 0 || idOrUrl === void 0) {
+        throw new UsageError(
+          "usage: harness link rm <issue> <link-id-or-url>"
+        );
+      }
+      requireIdentifiers2([issue]);
+      return linkRm(ctx, issue, idOrUrl);
+    });
+  }
+);
+var label2 = program.command("label").description("labels");
+label2.command("list").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => labelList(ctx)
+  );
+});
+label2.command("create").argument("[name]").option("--color <color>", "label color").option("--json", "emit JSON").action(
+  async (name, opts) => {
+    await withConfig(
+      opts.json === true,
+      true,
+      (ctx) => labelCreate(ctx, name, opts.color)
+    );
+  }
+);
+label2.command("update").description("rename or recolor a label").argument("[id]").option("--name <name>", "new name").option("--color <color>", "swatch name (red, blue, \u2026) or a hex code").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => labelUpdate(ctx, id, opts));
+});
+label2.command("delete").description("delete a label (refused while issues carry it)").argument("[id]").option("--yes", "confirm the deletion").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => labelDelete(ctx, id, opts));
+});
+var team = program.command("team").description("teams");
+team.command("list").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => teamList(ctx)
+  );
+});
+team.command("create").description("create a team, seeded with the default workflow states").option(
+  "--key <key>",
+  "identifier prefix for the team's issues, e.g. IOS (required)"
+).option("--name <name>", "display name (required)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    true,
+    (ctx) => teamCreate(ctx, opts)
+  );
+});
+team.command("rename").description("rename a team (the key is create-only)").argument("[key]").option("--name <name>", "new display name").option("--json", "emit JSON").action(async (key, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => teamRename(ctx, key, opts.name));
+});
+team.command("set-default").description("make this team the organization's default filing target").argument("[key]").option("--json", "emit JSON").action(async (key, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => teamSetDefault(ctx, key));
+});
+var state = program.command("state").description("a team's workflow states");
+state.command("list").description("list a team's workflow states").option("--team <key>", "team key (or HARNESS_TEAM)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => workflowStates(ctx, opts.team));
+});
+state.command("add").description("add a workflow state, appended after the team's existing ones").option("--team <key>", "team key (or HARNESS_TEAM)").option("--name <name>", "display name (required)").option("--type <type>", "backlog | unstarted | started | completed | canceled (required)").option("--color <color>", "swatch name").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, true, (ctx) => stateAdd(ctx, opts));
+});
+state.command("update").description("rename, retype or recolor a workflow state").argument("[id]").option("--team <key>", "team key (or HARNESS_TEAM)").option("--name <name>", "new name").option("--type <type>", "new type").option("--color <color>", "new swatch name").option("--json", "emit JSON").action(
+  async (id, opts) => {
+    await withConfig(opts.json === true, true, (ctx) => stateUpdate(ctx, id, opts));
+  }
+);
+state.command("order").description("reorder a team's states \u2014 pass EVERY state id, comma separated, in the order you want").argument("[ids]").option("--team <key>", "team key (or HARNESS_TEAM)").option("--json", "emit JSON").action(async (ids, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => stateOrder(ctx, ids, opts));
+});
+state.command("delete").description("delete a workflow state (refused while issues sit in it)").argument("[id]").option("--team <key>", "team key (or HARNESS_TEAM)").option("--yes", "confirm the deletion").option("--json", "emit JSON").action(async (id, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => stateDelete(ctx, id, opts));
+});
+var member = program.command("member").description("the organization's tracker roster");
+member.command("list").description("who can reach this organization's tracker, and at what rank").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => memberList(ctx));
+});
+member.command("add").description("grant a rank to an existing account, minting the membership").option("--email <email>", "address of an existing account (required)").option("--role <role>", "admin | staff | collaborator (required)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, true, (ctx) => memberAdd(ctx, opts));
+});
+member.command("set-role").description("change or revoke a member's rank; none revokes").argument("[user-id]").option("--role <role>", "admin | staff | collaborator | none (required)").option("--json", "emit JSON").action(async (userId, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => memberSetRole(ctx, userId, opts));
+});
+program.command("states").description("a team's workflow states (alias of `state list`)").option("--team <key>", "team key (or HARNESS_TEAM)").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => workflowStates(ctx, opts.team)
+  );
+});
+var user = program.command("user").description("users");
+user.command("list").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(
+    opts.json === true,
+    false,
+    (ctx) => userList(ctx)
+  );
+});
+program.command("upload").description("upload an image (25 MB) or H.264 MP4 video (100 MB, optional AAC audio); prints markdown").argument("[path]").option("--json", "emit JSON").action(async (path, opts) => {
+  await withConfig(opts.json === true, true, (ctx) => {
+    if (path === void 0)
+      throw new UsageError(
+        "usage: harness upload <path>  (png/jpg/webp/gif up to 25 MB; H.264 MP4 with optional AAC audio up to 100 MB)"
+      );
+    return upload(ctx, path);
+  });
+});
+var tools = program.command("tools").description(
+  "the capabilities Operator can use now in this organization (switched-off ones never appear); write and send capabilities need approval in the app"
+).option("--domain <domain>", "only this domain (`tools domains` lists them)").option("--cursor <cursor>", "continue from a page's cursor (from the paging notice)").option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+  requireToolsOpts(opts);
+  await withConfig(opts.json === true, false, (ctx) => toolsList(ctx, opts));
+});
+tools.command("search").description("search what Operator can use now by keyword, best match first").argument("[query...]").option("--domain <domain>", "only this domain").option("--cursor <cursor>", "continue from a page's cursor (from the paging notice)").option("--all", "follow every page").option("--json", "emit JSON").action(async (query2, opts) => {
+  const merged = { ...tools.opts(), ...opts };
+  if (query2.length === 0) {
+    throw new UsageError("usage: harness tools search <query> [--domain <domain>] [--all]");
+  }
+  requireSearchQuery(query2.join(" "));
+  requireToolsOpts(merged);
+  await withConfig(merged.json === true, false, (ctx) => toolsSearch(ctx, query2.join(" "), merged));
+});
+tools.command("domains").description("every domain Operator can use capabilities in, with how many").option("--json", "emit JSON").action(async (opts) => {
+  const parent = tools.opts();
+  if (parent.domain !== void 0 || parent.cursor !== void 0 || parent.all === true) {
+    throw new UsageError("usage: harness tools domains [--json] (it takes no --domain, --cursor or --all)");
+  }
+  await withConfig(opts.json === true || parent.json === true, false, (ctx) => toolsDomains(ctx));
+});
+program.command("tool").description("one capability Operator can use, with its whole input schema (or, for a read, its result schema)").argument("[id]").option("--schema <which>", "input (the default) or result, for a read").option("--json", "emit JSON").action(async (id, opts) => {
+  if (id === void 0) throw new UsageError("usage: harness tool <capability-id> [--schema input|result]");
+  requireCapabilityId(id);
+  requireSchemaView(opts.schema);
+  await withConfig(opts.json === true, false, (ctx) => toolShow(ctx, id, opts));
+});
+program.command("skills").description("the organization's skills assigned to Operator: identity and content checksum, never content").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => skillsList(ctx));
+});
+program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
+  const { startMcpServer } = await import("./server-TRXBTJSA.js");
+  await startMcpServer(invokedAs);
+});
+var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
+keys.command("list").description("provider slugs the org has keys for and the env var each maps to \u2014 never the values").option("--json", "emit JSON").action(async (opts) => {
+  await withConfig(opts.json === true, false, (ctx) => list2(ctx));
+});
+keys.command("exec").description(
+  "run a command with the org's keys in its environment and exit with its exit code: harness keys exec [--override] -- <command> [args...]"
+).argument("[command...]", "the command and its arguments").option("--override", "let fetched keys replace variables already set in this shell").option(
+  "--only <slugs>",
+  "pass only these provider slugs (comma-separated, repeatable); default: everything stored",
+  collect,
+  []
+).option("--json", "accepted for uniformity; stdout belongs to the command, so it changes nothing").passThroughOptions().action(async (command2, opts) => {
+  const only = opts.only.flatMap((value) => value.split(","));
+  await withConfig(
+    false,
+    false,
+    (ctx) => exec(ctx, { command: command2, override: opts.override === true, only })
+  );
+});
+var code = program.command("code").description("sync and inspect a code-index worktree overlay");
+code.command("sync").description("sync an overlay on a server-built GitHub base (needs harness:read and harness:write)").option("--path <directory>", "Git worktree (defaults to the current directory)").option("--skipped", "include the server base\u2019s skipped-files report").option("--json", "emit JSON").action(async (opts) => {
+  const target = enterWorktree(opts);
+  await withConfig(opts.json === true, true, (ctx) => sync(ctx, target));
+});
+code.command("status").description("inspect this worktree view; --skipped also asks for base status (needs harness:write)").option("--path <directory>", "Git worktree (defaults to the current directory)").option("--skipped", "include the server base\u2019s skipped-files report").option("--json", "emit JSON").action(async (opts) => {
+  const target = enterWorktree(opts);
+  await withConfig(opts.json === true, opts.skipped === true, (ctx) => status2(ctx, target));
+});
+for (const operation of ["search", "explain", "affected", "context"]) {
+  const query2 = code.command(operation).description({ search: "find indexed declarations", explain: "explain an opaque symbol ID and its callers", affected: "find impact from symbol IDs or file paths", context: "retrieve indexed source snippets within a token budget" }[operation]);
+  if (operation === "search" || operation === "explain" || operation === "context") query2.argument("[value]");
+  if (operation === "search") query2.option("--kind <kind>").option("--path-prefix <prefix>").option("--limit <n>", "1 to 100", integer2);
+  if (operation === "context") query2.option("--symbol <id>", "opaque ID from search");
+  if (operation === "context" || operation === "explain") query2.option("--budget-tokens <n>", "indexed snippet token budget", integer2);
+  if (operation === "affected") query2.option("--symbol <id>", "repeat for multiple IDs", (value, all) => [...all, value], []).option("--file <path>", "repeat for multiple paths", (value, all) => [...all, value], []).option("--depth <n>", "1 to 6", integer2).option("--include-ambiguous", "follow possible bindings too").option("--include-types", "follow type dependents too");
+  query2.option("--path <directory>", "Git worktree").option("--json", "emit response data, meta and guidance");
+  const run3 = async (value, opts) => {
+    const target = enterWorktree({ path: opts["path"] });
+    const params = {
+      ...operation === "search" || operation === "context" ? { q: value } : {},
+      ...operation === "explain" ? { symbol: value } : operation === "context" ? { symbol: opts["symbol"] } : {},
+      ...operation === "affected" ? { symbols: opts["symbol"], files: opts["file"], depth: opts["depth"], includeAmbiguous: opts["includeAmbiguous"], includeTypes: opts["includeTypes"] } : {},
+      kind: opts["kind"],
+      pathPrefix: opts["pathPrefix"],
+      limit: opts["limit"],
+      budgetTokens: opts["budgetTokens"]
+    };
+    validateQuery(operation, params);
+    await withConfig(opts["json"] === true, false, (ctx) => query(ctx, operation, params, target));
+  };
+  if (operation === "affected") query2.action(async (opts) => run3(void 0, opts));
+  else query2.action(run3);
+}
+var review = program.command("review").description("a pull request's enforced Review Council gate, and a retry of its latest attempt");
+review.command("status").description("the gate's enforced and advisory status, and a failed latest attempt with what comes next").argument("<pr>", "owner/repo#<pr>, the pull request URL, or <pr> with --repo or this checkout's origin").option("--repo <owner/repo>", "the repository a bare pull request number belongs to").option("--json", "emit JSON").action(async (pr, opts) => {
+  const ref = parsePullRequest(pr, opts.repo);
+  await withConfig(opts.json === true, false, (ctx) => status(ctx, ref));
+});
+review.command("retry").description(
+  "retry the latest gate attempt of the pull request's current head (needs reviews:write); the head, check and attempt are read from the gate status"
+).argument("<pr>", "owner/repo#<pr>, the pull request URL, or <pr> with --repo or this checkout's origin").option("--repo <owner/repo>", "the repository a bare pull request number belongs to").option("--reason <text>", "why the attempt is retried, recorded with it").option("--json", "emit JSON").action(async (pr, opts) => {
+  const ref = parsePullRequest(pr, opts.repo);
+  await withConfig(opts.json === true, true, (ctx) => retry(ctx, ref, opts.reason));
+});
+program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(
+  "--timeout <ms>",
+  "how long to wait for the browser callback",
+  integer2
+).option("--json", "emit JSON").action(
+  async (opts) => {
+    const repoLookup = findRepoConfig();
+    for (const warning of repoLookup.warnings)
+      writeStderr(warning + "\n");
+    const repoUrl = repoLookup.config?.url;
+    const url = opts.url ?? blankToUndefined(process.env["HARNESS_API_URL"]) ?? repoUrl ?? (repoLookup.config?.org === void 0 ? storedLoginUrl() : void 0) ?? DEFAULT_BASE_URL;
+    if (url === repoUrl && opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0) {
+      writeStderr(
+        `harness: host ${url} comes from ${repoLookup.config?.path}
+`
+      );
+    }
+    const repoSelected = opts.url === void 0 && blankToUndefined(process.env["HARNESS_API_URL"]) === void 0 && repoUrl !== void 0;
+    if (repoSelected && !isHostTrusted(url)) {
+      if (!canConfirmRepoLogin()) {
+        writeStderr("harness: cannot confirm a repo-selected host without a terminal \u2014 pass --url explicitly\n");
+        return exitWith(2);
+      }
+      if (!await confirmRepoLogin(url, "repo-config", repoLookup.config?.path)) return exitWith(2);
+    }
+    const options = { noBrowser: !opts.browser };
+    if (repoLookup.config?.org !== void 0) options.org = repoLookup.config.org;
+    if (opts.timeout !== void 0) options.timeoutMs = opts.timeout;
+    await finishAuth(await login(url, options), opts.json === true);
+  }
+);
+program.command("logout").description("revoke and forget the stored login").option("--json", "emit JSON").action(async (opts) => {
+  const selected = resolveConfig({ ...process.env, HARNESS_API_TOKEN: void 0 });
+  if (selected.kind === "error") {
+    writeStderr(`harness: ${selected.message}
+`);
+    return exitWith(2);
+  }
+  const path = selected.kind === "ok" ? selected.config.credentialsPath : selected.credentialsPath;
+  await finishAuth(await logout(path === void 0 ? {} : { credentialsPath: path }), opts.json === true);
+});
+program.command("whoami").description("show the resolved host and credential source").option("--json", "emit JSON").action(async (opts) => {
+  const resolved = resolveConfig();
+  for (const warning of resolved.warnings)
+    writeStderr(warning + "\n");
+  if (resolved.kind === "error") {
+    writeStderr(`harness: ${resolved.message}
+`);
+    return exitWith(2);
+  }
+  if (resolved.kind === "needs-login") {
+    writeStderr(loginHelp(resolved.baseUrl));
+    if (resolved.org !== void 0) writeStderr(`Choose organization ${resolved.org} when logging in.
+`);
+    return exitWith(2);
+  }
+  const source = blankToUndefined(process.env["HARNESS_API_TOKEN"]) !== void 0 ? "environment" : "stored login";
+  let result;
+  try {
+    result = await whoami(resolved.config, source);
+  } catch (error) {
+    if (!(error instanceof TransportError)) throw error;
+    writeStderr(`harness: cannot reach the API: ${clean(error.message)}
+`);
+    return exitWith(3);
+  }
+  await finishAuth(result, opts.json === true);
+});
+function storedLoginUrl() {
+  return readCredentials(defaultCredentialsPath())?.url;
+}
+function blankToUndefined(value) {
+  return value === void 0 || value.trim() === "" ? void 0 : value;
+}
+async function finishAuth(result, json2) {
+  if (result.ok) {
+    process.stdout.write(json2 ? json(result.json) : result.human);
+    return exitWith(0);
+  }
+  writeStderr(`harness: ${clean(result.message)}
+`);
+  return exitWith(1);
+}
+var argv = process.argv.slice();
+if (argv[2] === "--version" || argv[2] === "-V") argv[2] = "version";
+if (argv[2] === UPDATE_CHECK_COMMAND) {
+  await performUpdateCheck();
+  await exitWith(0);
+}
+try {
+  const notice = updateCheck();
+  if (notice !== null) writeStderr(notice);
+} catch {
+}
+if (invokedAs === "operator") {
+  const deprecation = operatorDeprecationNotice();
+  if (deprecation !== null) writeStderr(deprecation);
+}
+if (invokedAs === "operator") layoutOperatorHelp(program);
+if (argv.length <= 2) {
+  program.outputHelp({ error: true });
+  await exitWith(2);
+}
+try {
+  await program.parseAsync(argv);
+} catch (error) {
+  if (error instanceof UsageError) {
+    writeStderr(error.message + "\n");
+    await exitWith(2);
+  }
+  if (error instanceof CommanderError) {
+    if (error.code === "commander.helpDisplayed" || error.code === "commander.help") {
+      await exitWith(error.exitCode === 0 ? 0 : 2);
+    }
+    await exitWith(2);
+  }
+  throw error;
+}