@nurix/nustack 0.19.0 → 0.19.2

package/dist/commands/mcp.js

@@ -0,0 +1,103 @@
+import { ensureAuthWithRecovery } from "../lib/auth_recovery.js";
+import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+import { authorizedFetch, resolveNuStackUrl } from "../lib/nustack_client.js";
+import { resolveProjectId } from "../lib/project_context.js";
+import { doorUrlFor, runRelay } from "../lib/mcp/relay.js";
+import { applyEdit, ClientConfigError, detectClients, MCP_CLIENTS, planEdit, targetFor } from "../lib/mcp/clients.js";
+async function runServe(options, globals) {
+    const baseUrl = resolveNuStackUrl(globals);
+    const flag = options.project?.trim();
+    const bound = flag ? null : await resolveProjectId(process.cwd(), {});
+    const defaultProjectId = flag ?? (bound?.ok ? bound.projectId : null);
+    const doorUrl = doorUrlFor(baseUrl, process.env.NUSTACK_MCP_URL);
+    process.stderr.write(`nustack mcp: relaying to ${doorUrl}${defaultProjectId ? `, default project ${defaultProjectId}` : ""}\n`);
+    await runRelay({
+        doorUrl,
+        bearer: async () => (await ensureAuthWithRecovery(baseUrl, true))?.accessToken ?? null,
+        defaultProjectId,
+        fetch: (url, init) => authorizedFetch(url, { ...init, signal: AbortSignal.timeout(60_000) }),
+        input: process.stdin,
+        output: process.stdout,
+        log: (line) => process.stderr.write(`${line}\n`),
+    });
+}
+function chosenClients(raw) {
+    if (!raw) {
+        const found = detectClients();
+        return found.length > 0 ? found : ["claude"];
+    }
+    const names = raw.split(",").map((name) => name.trim()).filter(Boolean);
+    const unknown = names.filter((name) => !MCP_CLIENTS.includes(name));
+    if (unknown.length > 0)
+        return `Unknown client ${unknown.join(", ")}; choose from ${MCP_CLIENTS.join(", ")}.`;
+    return names;
+}
+async function runEdit(command, options) {
+    const json = options.json === true;
+    const fail = (code, message) => {
+        if (json)
+            printJsonError(command, { code, message });
+        else {
+            console.error(message);
+            process.exitCode = 1;
+        }
+    };
+    const scope = (options.scope ?? "user");
+    if (scope !== "user" && scope !== "project")
+        return fail("INVALID_ARGUMENT", "--scope takes user or project.");
+    const clients = chosenClients(options.client);
+    if (typeof clients === "string")
+        return fail("INVALID_ARGUMENT", clients);
+    const install = command === "mcp install";
+    const rows = [];
+    for (const client of clients) {
+        const target = targetFor(client, scope, process.cwd());
+        if (!target) {
+            rows.push({ client, scope, path: null, action: "skipped", reason: `${client} has no ${scope}-scope MCP configuration` });
+            continue;
+        }
+        try {
+            const planned = await planEdit(target, install);
+            if (!options.dryRun)
+                await applyEdit(target, planned);
+            rows.push({ client, scope, path: target.file, action: planned.action });
+        }
+        catch (error) {
+            if (!(error instanceof ClientConfigError))
+                throw error;
+            rows.push({ client, scope, path: target.file, action: "skipped", reason: error.message });
+        }
+    }
+    if (json) {
+        printJsonSuccess(command, { dryRun: options.dryRun === true, changes: rows });
+        return;
+    }
+    for (const row of rows) {
+        const verb = options.dryRun && (row.action === "added" || row.action === "updated" || row.action === "removed") ? `would be ${row.action}` : row.action;
+        console.log(`${row.client.padEnd(7)} ${verb.padEnd(16)} ${row.path ?? ""}${row.reason ? `  (${row.reason})` : ""}`);
+    }
+    if (install && !options.dryRun && rows.some((row) => row.action === "added" || row.action === "updated")) {
+        console.error("Restart the agent to pick up the nustack MCP server.");
+    }
+}
+export function registerMcpCommands(program, getGlobalOptions) {
+    const mcp = program.command("mcp").description("NuStack as an MCP server for coding agents");
+    mcp.command("serve")
+        .description("Relay an agent's MCP stdio to NuStack with this CLI's credential (launched by the agent, not by you)")
+        .option("--project <id>", "the Project a Project tool acts on when the agent names none (default: this folder's)")
+        .action(async (options) => runServe(options, getGlobalOptions()));
+    mcp.command("install")
+        .description("Register `nustack mcp serve` with Claude Code, Cursor, Codex or VS Code")
+        .option("--client <names>", `comma-separated: ${MCP_CLIENTS.join(", ")} (default: the clients found on this machine)`)
+        .option("--scope <scope>", "user (your home folder) or project (this folder's files)", "user")
+        .option("--dry-run", "print each file and the change, write nothing")
+        .option("--json", "emit the versioned machine envelope")
+        .action(async (options) => runEdit("mcp install", options));
+    mcp.command("uninstall")
+        .description("Remove the entry `nustack mcp install` wrote, leaving everything else as it was")
+        .option("--client <names>", `comma-separated: ${MCP_CLIENTS.join(", ")} (default: the clients found on this machine)`)
+        .option("--scope <scope>", "user or project", "user")
+        .option("--dry-run", "print each file and the change, write nothing")
+        .option("--json", "emit the versioned machine envelope")
+        .action(async (options) => runEdit("mcp uninstall", options));
+}

package/dist/commands/project.js

@@ -2,7 +2,6 @@ import { randomUUID } from "node:crypto";
 import path from "node:path";
 import * as p from "@clack/prompts";
 import { createProjectViaAsk, getProject, listProjects, listOrganizations, publishProject, resolveNuStackUrl, unpublishProject, } from "../lib/nustack_client.js";
-import { ensureAccessToken } from "../lib/auth_grant.js";
 import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
 import { resolveProjectId, resolveOrganizationId } from "../lib/project_context.js";
 import { readActiveOrganizationContext } from "./organization.js";
@@ -16,6 +15,7 @@ import { resolveRepository } from "../lib/git-sync/core/repository.js";
 import { readProjectManifests } from "../lib/onboarding/manifest_writer.js";
 import { hasManifest, scaffoldManifest } from "../lib/manifest.js";
 import { toolkitCompatibility } from "../lib/etna/reconcile.js";
+import { readMountStateSync } from "../lib/harness/mount.js";
 import { attachExistingGit } from "../lib/onboarding/attach_existing_git.js";
 import { webFirstAttach } from "../lib/onboarding/web_first_attach.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
@@ -153,29 +153,20 @@ export async function runProjectAttach(options, globals) {
         store.close();
     }
 }
-export async function runProjectStatus(options, globals) {
-    const json = options.json === true;
-    const cwd = process.cwd();
-    const project = await resolveProjectId(cwd, { project: options.project });
-    if (!project.ok) {
-        emitFail("project status", json, "PROJECT_CONTEXT_MISSING", project.message);
-        return;
-    }
-    const baseUrl = resolveNuStackUrl(globals);
-    const auth = await ensureAccessToken(baseUrl).catch(() => null);
+export async function readProjectOverview(projectId, cwd, baseUrl, accessToken) {
     const store = await openLocalStore();
     let binding = null;
     try {
-        binding = findBindingForProject(store, project.projectId, cwd);
+        binding = findBindingForProject(store, projectId, cwd);
     }
     finally {
         store.close();
     }
     let cloudProject = null;
     let cloud = null;
-    if (auth) {
+    if (accessToken) {
         try {
-            cloudProject = await getProject(baseUrl, auth.accessToken, project.projectId);
+            cloudProject = await getProject(baseUrl, accessToken, projectId);
             if (cloudProject.toolkit && cloudProject.toolkit.version && cloudProject.toolkit.rendererVersion && cloudProject.toolkit.placementMapVersion) {
                 cloud = {
                     name: cloudProject.toolkit.name,
@@ -183,6 +174,7 @@ export async function runProjectStatus(options, globals) {
                     rendererVersion: cloudProject.toolkit.rendererVersion,
                     placementMapVersion: cloudProject.toolkit.placementMapVersion,
                     catalogVersionId: null,
+                    harnessVersion: cloudProject.harness?.version ?? null,
                 };
             }
         }
@@ -190,37 +182,28 @@ export async function runProjectStatus(options, globals) {
             cloudProject = null;
         }
     }
-    const compatibility = toolkitCompatibility(binding ?? { etnaProfileJson: null }, cloud);
-    if (json) {
-        printJsonSuccess("project status", {
-            projectId: project.projectId,
-            cloudReachable: cloudProject !== null,
-            cloud: cloudProject
-                ? { label: cloudProject.label, status: cloudProject.status, publicationState: cloudProject.publicationState, initStatus: cloudProject.initStatus }
-                : null,
-            binding: binding
-                ? {
-                    id: binding.id,
-                    boundBranch: binding.boundBranch,
-                    lastProcessedCommitId: binding.lastProcessedCommitId,
-                    lastAppliedProjectSequence: binding.lastAppliedProjectSequence,
-                    status: binding.status,
-                }
-                : null,
-            toolkit: { compatible: compatibility.compatible, blocksWrites: compatibility.blocksWrites, reason: compatibility.reason },
-        });
-        return;
-    }
-    console.log(`Project ${project.projectId}`);
-    console.log(`  cloud:    ${cloudProject ? `${cloudProject.label} — ${cloudProject.status} / ${cloudProject.publicationState}` : "(unreachable — local-only view)"}`);
-    if (binding) {
-        console.log(`  binding:  ${binding.id} on ${binding.boundBranch} (${binding.status})`);
-        console.log(`  cursor:   processed=${binding.lastProcessedCommitId?.slice(0, 12) ?? "—"}  applied@${binding.lastAppliedProjectSequence}`);
-    }
-    else {
-        console.log("  binding:  (this folder is not bound on this device)");
-    }
-    console.log(`  toolkit:  ${compatibility.blocksWrites ? `BLOCKED — ${compatibility.reason}` : "clear (projection and sync writes allowed)"}`);
+    const compatibility = toolkitCompatibility(readMountStateSync(binding?.repositoryRoot ?? cwd), cloud);
+    return { cloudProject, binding, compatibility };
+}
+export function projectOverviewJson(projectId, overview) {
+    const { cloudProject, binding, compatibility } = overview;
+    return {
+        projectId,
+        cloudReachable: cloudProject !== null,
+        cloud: cloudProject
+            ? { label: cloudProject.label, status: cloudProject.status, publicationState: cloudProject.publicationState, initStatus: cloudProject.initStatus }
+            : null,
+        binding: binding
+            ? {
+                id: binding.id,
+                boundBranch: binding.boundBranch,
+                lastProcessedCommitId: binding.lastProcessedCommitId,
+                lastAppliedProjectSequence: binding.lastAppliedProjectSequence,
+                status: binding.status,
+            }
+            : null,
+        toolkit: { compatible: compatibility.compatible, blocksWrites: compatibility.blocksWrites, reason: compatibility.reason },
+    };
 }
 export async function runProjectOpen(options, globals) {
     const json = options.json === true;
@@ -452,12 +435,6 @@ export function registerProjectCommands(projectCommand, getGlobalOptions) {
         .option("--yes", "confirm populated-folder onboarding and rebind")
         .option("--json", "emit the versioned machine envelope")
         .action(async (options) => runProjectAttach(options, getGlobalOptions()));
-    projectCommand
-        .command("status")
-        .description("Show the cloud Project summary merged with the local binding (degraded offline)")
-        .option("--project <id>", "the Project to act as (defaults to the bound repository)")
-        .option("--json", "emit the versioned machine envelope")
-        .action(async (options) => runProjectStatus(options, getGlobalOptions()));
     projectCommand
         .command("open")
         .description("Open the Project in the browser (--json prints the URL instead of launching)")

package/dist/commands/records.js

@@ -0,0 +1,150 @@
+import { existsSync } from "node:fs";
+import { openLocalStore } from "../lib/local_store/database.js";
+import { stateDbPath } from "../lib/local_store/paths.js";
+import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+import { RECORDS_BATCH_CAP, drainOutbox, drainStore, emitRecords, isRecordKind, listOutbox, listStored, resolveDoor, } from "../lib/records/door.js";
+async function readStdin() {
+    if (process.stdin.isTTY)
+        return "";
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8");
+}
+function parseRows(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const list = Array.isArray(parsed) ? parsed : [parsed];
+    const rows = list.filter((row) => !!row && typeof row === "object" && typeof row.anchor === "string" && row.anchor.trim() !== "");
+    return rows.length === list.length ? rows : null;
+}
+function emitLine(outcome) {
+    if (outcome.rung === 1)
+        return `records emit: landed ${outcome.landed} on NuStack (${outcome.projectId})\n`;
+    if (outcome.rung === 2)
+        return `records emit: the door refused (${outcome.error}); ${outcome.keys.length} row(s) wait in the outbox\n`;
+    return `records emit: ${outcome.reason}; ${outcome.keys.length} row(s) kept in the local store\n`;
+}
+export async function runRecordsEmit(options, globals) {
+    const json = options.json === true;
+    const refuse = (message) => {
+        if (json)
+            printJsonError("records emit", { code: "VALIDATION_FAILED", message });
+        else {
+            process.stderr.write(`records emit: ${message}\n`);
+            process.exitCode = 1;
+        }
+    };
+    if (!isRecordKind(options.kind))
+        return refuse("--kind must be backlog, backlog.remove, bookkeeping or gate_event");
+    const rows = parseRows(options.row ?? (await readStdin()));
+    if (!rows || rows.length === 0)
+        return refuse("the rows must be JSON — one object or an array — each with an anchor");
+    const root = options.root ?? process.cwd();
+    const resolution = await resolveDoor(root, globals, options.project);
+    const store = await openLocalStore();
+    try {
+        const outcomes = [];
+        for (let start = 0; start < rows.length; start += RECORDS_BATCH_CAP) {
+            outcomes.push(await emitRecords(store, resolution, options.kind, rows.slice(start, start + RECORDS_BATCH_CAP)));
+        }
+        if (outcomes.every((outcome) => outcome.rung === 1))
+            await drainOutbox(store, globals, { dueOnly: true });
+        const last = outcomes[outcomes.length - 1];
+        const keys = outcomes.flatMap((outcome) => outcome.keys);
+        if (json)
+            printJsonSuccess("records emit", { ...last, keys });
+        else
+            process.stdout.write(emitLine({ ...last, keys }));
+    }
+    finally {
+        store.close();
+    }
+}
+export async function runRecordsSync(options, globals) {
+    const store = await openLocalStore();
+    try {
+        const outbox = await drainOutbox(store, globals);
+        const stored = await drainStore(store, globals);
+        const result = {
+            sent: outbox.sent + stored.sent,
+            waiting: listOutbox(store).length,
+            stored: listStored(store).length,
+            lastError: outbox.lastError ?? stored.lastError,
+        };
+        if (options.json)
+            printJsonSuccess("records sync", result);
+        else
+            process.stdout.write(`records sync: sent ${result.sent}; ${result.waiting} wait in the outbox, ${result.stored} kept locally\n`);
+    }
+    finally {
+        store.close();
+    }
+}
+export async function runRecordsList(options) {
+    const store = await openLocalStore();
+    try {
+        const outbox = listOutbox(store, options.project);
+        const stored = listStored(store, options.project ? { projectId: options.project } : {});
+        const newest = [...outbox].sort((a, b) => b.createdAtMs - a.createdAtMs).find((row) => row.lastError !== null);
+        const data = {
+            outboxCount: outbox.length,
+            storeCount: stored.length,
+            lastError: newest?.lastError ?? null,
+            outbox,
+            store: stored,
+        };
+        if (options.json)
+            printJsonSuccess("records list", data);
+        else {
+            process.stdout.write(`records list: ${data.outboxCount} in the outbox, ${data.storeCount} kept locally\n`);
+            if (data.lastError)
+                process.stdout.write(`  last error: ${data.lastError}\n`);
+        }
+    }
+    finally {
+        store.close();
+    }
+}
+export async function drainBeforeCommand(globals) {
+    if (!existsSync(stateDbPath()))
+        return;
+    try {
+        const store = await openLocalStore();
+        try {
+            await drainOutbox(store, globals, { dueOnly: true, limit: 20 });
+        }
+        finally {
+            store.close();
+        }
+    }
+    catch {
+    }
+}
+export function registerRecordsCommands(recordsCommand, getGlobalOptions) {
+    recordsCommand
+        .command("emit")
+        .description("Land records on NuStack, else park them in the outbox, else keep them locally")
+        .option("--kind <kind>", "backlog, backlog.remove, bookkeeping or gate_event")
+        .option("--row <json>", "the row, or an array of rows, as JSON (default: read from stdin)")
+        .option("--root <dir>", "the folder the records are about (default: the current directory)")
+        .option("--project <id>", "the Project, when the folder carries no binding marker")
+        .option("--json", "emit the versioned machine envelope")
+        .action(async (options) => runRecordsEmit(options, getGlobalOptions()));
+    recordsCommand
+        .command("sync")
+        .description("Send every outbox row, and stored rows whose folder now has a door")
+        .option("--json", "emit the versioned machine envelope")
+        .action(async (options) => runRecordsSync(options, getGlobalOptions()));
+    recordsCommand
+        .command("list")
+        .description("Show the rows that have not reached NuStack: the outbox and the local store")
+        .option("--project <id>", "only this Project's rows")
+        .option("--json", "emit the versioned machine envelope")
+        .action(async (options) => runRecordsList(options));
+}

package/dist/commands/toolkit.js

@@ -9,6 +9,7 @@ import { resolveRepository } from "../lib/git-sync/core/repository.js";
 import { readProjectManifests, diagnoseManifests } from "../lib/onboarding/manifest_writer.js";
 import { fetchToolkitProfile, ToolkitProfileUnavailableError } from "../lib/etna/profile.js";
 import { buildReconcilePlan, applyReconcile, toolkitCompatibility } from "../lib/etna/reconcile.js";
+import { readMountStateSync } from "../lib/harness/mount.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
 function emitFail(command, json, code, message) {
     if (json)
@@ -59,8 +60,7 @@ export async function runToolkitStatus(options, globals) {
     }
     const manifests = await readProjectManifests(ctx.root);
     const diagnosis = diagnoseManifests({ name: cloud.name, version: cloud.version }, manifests.projectManifest?.toolkit ?? null, manifests.serviceToolkit);
-    const binding = await withStore((store) => getBindingByRepositoryRoot(store, ctx.root));
-    const compatibility = toolkitCompatibility(binding ?? { etnaProfileJson: null }, cloud);
+    const compatibility = toolkitCompatibility(readMountStateSync(ctx.root), cloud);
     if (json) {
         printJsonSuccess("toolkit status", {
             projectId: ctx.projectId,

package/dist/commands/whoami.js

@@ -0,0 +1,79 @@
+import { envToken, knownDeviceId, PERSONAL_TOKEN_PREFIX } from "../lib/auth_grant.js";
+import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
+import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+import { authorizedFetch, errorMessage, resolveNuStackUrl } from "../lib/nustack_client.js";
+import { readActiveOrganizationContext } from "./organization.js";
+function emitFail(json, code, message) {
+    if (json)
+        printJsonError("whoami", { code, message });
+    else {
+        console.error(message);
+        process.exitCode = 1;
+    }
+}
+function localSource() {
+    const fromEnv = envToken();
+    if (fromEnv?.kind === "ok") {
+        const id = fromEnv.token.slice(PERSONAL_TOKEN_PREFIX.length).split("_")[0] ?? "";
+        return { kind: "env_token", label: `NUSTACK_TOKEN (${PERSONAL_TOKEN_PREFIX}${id.slice(0, 8)}…)` };
+    }
+    const device = knownDeviceId();
+    return { kind: "device", label: device ? `device sign-in (device ${device.slice(0, 8)}…)` : "device sign-in" };
+}
+export async function runWhoami(options, globals) {
+    const json = options.json === true;
+    const baseUrl = resolveNuStackUrl(globals);
+    const auth = await ensureAuthWithRecovery(baseUrl, json);
+    if (!auth) {
+        const failure = lastAuthFailure();
+        emitFail(json, failure.code, failure.message);
+        return;
+    }
+    let answer;
+    try {
+        const response = await authorizedFetch(`${baseUrl}/api/v2/auth/session`, {
+            headers: { Authorization: `Bearer ${auth.accessToken}` },
+            signal: AbortSignal.timeout(10_000),
+        });
+        const payload = (await response.json().catch(() => null));
+        if (response.status === 401) {
+            emitFail(json, "SIGNED_OUT", "NuStack does not recognise this credential — run `nustack login`, or mint a new token with `nustack token create`.");
+            return;
+        }
+        if (!response.ok || !payload?.data) {
+            emitFail(json, payload?.error?.code ?? "REQUEST_FAILED", errorMessage(payload, response.status, "whoami failed"));
+            return;
+        }
+        answer = payload.data;
+    }
+    catch (error) {
+        emitFail(json, "REQUEST_FAILED", error instanceof Error ? error.message : String(error));
+        return;
+    }
+    const source = localSource();
+    const localOrganization = await readActiveOrganizationContext().catch(() => null);
+    const identity = answer.user ? answer.user.email : answer.principal.label;
+    if (json) {
+        printJsonSuccess("whoami", { ...answer, source: source.kind, localOrganizationId: localOrganization, baseUrl });
+        return;
+    }
+    console.log(identity);
+    console.error(`  via        ${source.label}${answer.via ? ` · the server saw ${answer.via}` : ""}`);
+    if (answer.user === null)
+        console.error(`  principal  ${answer.principal.id} · role ${answer.role}`);
+    const organization = answer.organizationId ?? "none";
+    if (localOrganization && answer.organizationId && localOrganization !== answer.organizationId) {
+        console.error(`  org        ${organization} on the server — this machine's active Organization differs: ${localOrganization}`);
+    }
+    else {
+        console.error(`  org        ${organization}${localOrganization ? " (active here too)" : ""}`);
+    }
+    console.error(`  base URL   ${baseUrl}`);
+}
+export function registerWhoamiCommand(program, getGlobalOptions) {
+    program
+        .command("whoami")
+        .description("Who NuStack says this credential is, how it arrived, and the Organization it resolves")
+        .option("--json", "emit the versioned machine envelope")
+        .action(async (options) => runWhoami(options, getGlobalOptions()));
+}

package/dist/index.js

@@ -20,12 +20,20 @@ import { runSearch, runSearchServices } from "./commands/search.js";
 import { runDeviceList, runDeviceRevoke, runDeviceStatus } from "./commands/device.js";
 import { registerProjectSyncCommands } from "./commands/project-sync.js";
 import { registerProjectCommands } from "./commands/project.js";
+import { registerDeployCommands, registerLogsCommand, registerProjectSetCommand } from "./commands/deploy.js";
+import { registerActivityCommand } from "./commands/activity.js";
+import { registerWhoamiCommand } from "./commands/whoami.js";
+import { registerApiCommand } from "./commands/api.js";
+import { registerMcpCommands } from "./commands/mcp.js";
+import { NON_INTERACTIVE_VARIABLE } from "./lib/interactive.js";
 import { runOrganizationList, runOrganizationCreate, runOrganizationUse } from "./commands/organization.js";
 import { runDocsList, runDocsShow, runDocsStatus } from "./commands/docs.js";
 import { runHandoffList, runHandoffShow } from "./commands/handoff.js";
 import { runToolkitStatus, runToolkitReconcile } from "./commands/toolkit.js";
+import { runHarnessMount, runHarnessStatus } from "./commands/harness.js";
 import { runSessionsList, runSessionsPrune, runSessionsRecord, runSessionsServe, } from "./commands/sessions.js";
 import { registerReviewCommands } from "./commands/review.js";
+import { drainBeforeCommand, registerRecordsCommands } from "./commands/records.js";
 import { runAgentContext, runAgentHookInstall, runAgentHookRemove } from "./commands/agent.js";
 import { printJsonError } from "./lib/json_output.js";
 import { setCliVersion } from "./lib/auth_grant.js";
@@ -37,6 +45,7 @@ program
     .description("Bootstrap NuStack services into your repo via the NuStack discovery plane.")
     .version(version)
     .option("--nustack-url <url>", "NuStack base URL (defaults to $NUSTACK_URL, then the hosted instance)")
+    .option("--non-interactive", `never prompt — take the default or refuse with a coded error (also $${NON_INTERACTIVE_VARIABLE}=1)`)
     .action(async () => runBootstrap(program.opts()));
 program.addHelpText("after", "\nRun `nustack` with no command to bootstrap: it checks your sign-in, runs login if needed, then init.");
 program
@@ -122,6 +131,11 @@ program
     .option("--json", "emit the versioned machine envelope (secrets and absolute paths redacted)")
     .option("--local-verbose", "include Device-local absolute paths in the output")
     .action(async (options) => runDoctor({ ...program.opts(), ...options }));
+registerDeployCommands(program, () => program.opts());
+registerLogsCommand(program, () => program.opts());
+registerWhoamiCommand(program, () => program.opts());
+registerApiCommand(program, () => program.opts());
+registerMcpCommands(program, () => program.opts());
 program
     .command("open <service>")
     .description("Open the service's dev endpoint (or repository) in the browser")
@@ -214,8 +228,17 @@ organization
     .action(async (target, options) => runOrganizationUse(target, options, program.opts()));
 const project = program.command("project").description("Work with NuStack Projects");
 registerProjectCommands(project, () => program.opts());
+registerProjectSetCommand(project, () => program.opts());
+registerActivityCommand(project, () => program.opts());
 registerProjectSyncCommands(project, () => program.opts());
 registerReviewCommands(program.command("review").description("Read and mirror NuStack Review items"), () => program.opts());
+registerRecordsCommands(program.command("records").description("Emit, send and list harness records"), () => program.opts());
+program.hook("preAction", async (_program, action) => {
+    if (program.opts().nonInteractive)
+        process.env[NON_INTERACTIVE_VARIABLE] = "1";
+    if (action.parent?.name() !== "records")
+        await drainBeforeCommand(program.opts());
+});
 const docs = program.command("docs").description("Work with a Project's Documents");
 docs
     .command("list")
@@ -275,6 +298,20 @@ sessions
     .option("--force", "also reclaim an unmerged or dirty session — never one whose engine is running")
     .option("--json", "emit the versioned machine envelope")
     .action(async (options) => runSessionsPrune(options));
+const harness = program.command("harness").description("Mount the Project's harness and compare it with the cloud pin");
+harness
+    .command("mount [path]")
+    .description("Mount the resolved harness version into a checkout (default: the current repository)")
+    .option("--project <id>", "the Project to act as (defaults to the bound repository)")
+    .option("--manifest <url>", "mount this manifest instead of the one the Project resolves")
+    .option("--json", "emit the versioned machine envelope")
+    .action(async (target, options) => runHarnessMount(target, options, program.opts()));
+harness
+    .command("status")
+    .description("Print the mounted harness against the cloud pin; exits 1 when they differ")
+    .option("--project <id>", "the Project to act as (defaults to the bound repository)")
+    .option("--json", "emit the versioned machine envelope")
+    .action(async (options) => runHarnessStatus(options, program.opts()));
 const toolkit = program.command("toolkit").description("Inspect and reconcile the Project's toolkit pin");
 toolkit
     .command("status")

package/dist/lib/etna/manager.js

@@ -2,6 +2,7 @@ import { detectPackageManager, installPackage } from "../package_manager.js";
 import { assertSafePackageName } from "../guards.js";
 import { updateBindingEtnaProfile } from "../local_store/bindings.js";
 import { serializeProfileForBinding } from "./profile.js";
+import { mountHarness } from "../harness/mount.js";
 export function toolkitPackageName(profile) {
     if (!profile.name.startsWith("@"))
         return null;
@@ -15,7 +16,17 @@ export function toolkitPackageName(profile) {
 export async function installToolkit(store, bindingId, profile, cwd, deps = {}) {
     const packageName = toolkitPackageName(profile);
     let result;
-    if (!packageName) {
+    const manifestUrl = deps.manifestUrl ?? profile.manifestUrl ?? null;
+    if (manifestUrl) {
+        try {
+            await (deps.mount ?? mountHarness)(cwd, manifestUrl);
+            result = { ok: true, installed: true, skipped: false, reason: "mounted" };
+        }
+        catch (error) {
+            result = { ok: false, installed: false, skipped: false, reason: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    else if (!packageName) {
         result = { ok: true, installed: false, skipped: true, reason: "device_level_toolkit" };
     }
     else {

package/dist/lib/etna/profile.js

@@ -19,6 +19,8 @@ export async function fetchToolkitProfile(baseUrl, accessToken, projectId) {
         rendererVersion: typeof toolkit.rendererVersion === "string" ? toolkit.rendererVersion : "",
         placementMapVersion: typeof toolkit.placementMapVersion === "string" ? toolkit.placementMapVersion : "",
         catalogVersionId: null,
+        harnessVersion: project.harness?.version ?? null,
+        manifestUrl: project.harness?.manifestUrl ?? null,
     };
 }
 export function toolkitProfileFromManifest(manifest) {

package/dist/lib/etna/reconcile.js

@@ -19,18 +19,12 @@ export function parseRecordedToolkit(binding) {
         return null;
     }
 }
-export function toolkitCompatibility(binding, cloud) {
-    const recorded = parseRecordedToolkit(binding);
-    if (!recorded || !cloud)
+export function toolkitCompatibility(mounted, cloud) {
+    if (!mounted || !cloud)
         return { compatible: true, blocksWrites: false, reason: null };
-    if (recorded.name !== cloud.name) {
-        return { compatible: false, blocksWrites: true, reason: `toolkit name diverges (local ${recorded.name} vs cloud ${cloud.name})` };
-    }
-    if (recorded.version !== cloud.version) {
-        return { compatible: false, blocksWrites: true, reason: `toolkit version diverges (local ${recorded.version} vs cloud ${cloud.version})` };
-    }
-    if (cloud.rendererVersion && recorded.rendererVersion && recorded.rendererVersion !== cloud.rendererVersion) {
-        return { compatible: false, blocksWrites: true, reason: `renderer version diverges (local ${recorded.rendererVersion} vs cloud ${cloud.rendererVersion})` };
+    const pinned = cloud.harnessVersion ?? cloud.version;
+    if (mounted.version !== pinned) {
+        return { compatible: false, blocksWrites: true, reason: `mounted harness ${mounted.version} differs from the cloud pin ${pinned}` };
     }
     return { compatible: true, blocksWrites: false, reason: null };
 }

package/dist/lib/guards.js

@@ -90,6 +90,18 @@ export function assertSafeOpaqueId(label, raw) {
     }
     return raw;
 }
+export function assertSafeApiPath(origin, raw) {
+    assertNoControlChars("The API path", raw);
+    if (!raw.startsWith("/") || raw.startsWith("//") || /^\/*[a-z][a-z0-9+.-]*:/i.test(raw) || raw.includes("\\")) {
+        throw new Error(`The API path must be a path on the NuStack origin, starting with a single "/" (got ${raw})`);
+    }
+    const base = new URL(origin);
+    const joined = new URL(raw, base);
+    if (joined.protocol !== base.protocol || joined.host !== base.host) {
+        throw new Error(`The API path leaves the NuStack origin (${raw})`);
+    }
+    return joined;
+}
 export function assertSafeBrowserUrl(raw) {
     assertNoControlChars("The approval URL", raw);
     let url;