opencode-harness-kit 0.3.5 → 0.3.7

package/CHANGELOG.md

@@ -14,6 +14,37 @@ is not happening.
 
 ## [Unreleased]
 
+## [0.3.7] — 2026-10-20
+
+### Fixed
+
+- **`oc-harness trust` no longer reports a failed create as a configured
+  one.** It printed "the trusted publisher is configured" after npm refused,
+  because it checked the error TEXT rather than the exit code. The user walks
+  away believing the publish path is fixed and finds out at the next release.
+  The exit code is what decides now, and npm's own words are printed when it
+  is not zero.
+- **A failed read is reported as a failed read**, with npm's answer attached,
+  rather than as "nothing is configured" - which sent the reader off to
+  create a configuration that already existed.
+- **The one-time password prompt goes to stderr, on a line of its own.** A
+  question buried in npm's output is a question nobody answers.
+
+## [0.3.6] — 2026-10-20
+
+### Fixed
+
+- **`oc-harness trust` asks for the one-time password itself.** npm's own
+  helper opens a browser for it, but only when stdin and stdout are both
+  terminals — and under `npx` they are not. The result was a failure that
+  printed a web URL masked as `auth/cli/***`, which cannot be opened. The code
+  is asked for in the terminal now, and `--otp=<code>` works where there is
+  none.
+- **A failed read is no longer reported as "nothing is configured".** A
+  package with no trusted publisher and a call that could not read one are
+  different facts, and treating the second as the first sends you off to
+  create a configuration that already exists.
+
 ## [0.3.5] — 2026-10-20
 
 ### Added
@@ -304,7 +335,9 @@ silent in the worst way:
 
 ---
 
-[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.5...HEAD
+[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.7...HEAD
+[0.3.7]: https://github.com/pham-canh/space-harness/compare/v0.3.6...v0.3.7
+[0.3.6]: https://github.com/pham-canh/space-harness/compare/v0.3.5...v0.3.6
 [0.3.5]: https://github.com/pham-canh/space-harness/compare/v0.3.4...v0.3.5
 [0.3.4]: https://github.com/pham-canh/space-harness/compare/v0.3.1...v0.3.4
 [0.3.1]: https://github.com/pham-canh/space-harness/compare/v0.3.0...v0.3.1

package/bin/oc-harness.mjs

@@ -1411,7 +1411,7 @@ try {
       cmdLanes()
       break
     case "trust":
-      process.exitCode = trustMain(args.slice(1))
+      process.exitCode = await trustMain(args.slice(1))
       break
     case "doctor":
       await cmdDoctor()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-harness-kit",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Harness kit for OpenCode: capability profiles, a fleet of job lanes with one free model each, role-based reasoning effort, context pruning, and measured baselines.",
   "license": "MIT",
   "homepage": "https://github.com/pham-canh/space-harness#readme",

package/src/trust.js

@@ -83,22 +83,111 @@ function npm(args, opts = {}) {
   }
 }
 
+/**
+ * Run npm, and if it asks for a one-time password, ask for one here and run
+ * it again.
+ *
+ * npm's own helper for this opens a browser - but only when stdin and stdout
+ * are both terminals, and under `npx` they are not. The result is a failure
+ * that prints a web URL masked as `auth/cli/***`, which cannot be opened.
+ *
+ * So the code is asked for here, and the same code is passed straight back to
+ * npm as `--otp`.
+ *
+ * @param {string[]} args
+ * @param {{ otp?: string }} [state]
+ * @returns {Promise<{ out: string, code: number }>}
+ */
+async function npmWithOtp(args, state = {}) {
+  /** @param {string[]} extra */
+  const run = (extra) => {
+    try {
+      return {
+        out: execFileSync("npm", [...args, ...extra], {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "pipe"],
+        }),
+        code: 0,
+      }
+    } catch (err) {
+      const e = /** @type {any} */ (err)
+      return { out: `${e.stdout ?? ""}${e.stderr ?? ""}`, code: e.status ?? 1 }
+    }
+  }
+
+  const withOtp = state.otp ? [`--otp=${state.otp}`] : []
+  let result = run(withOtp)
+  if (result.code === 0 || !/one-time password|EOTP/i.test(result.out)) return result
+
+  // npm wants a code. Get one.
+  const code = state.otp ?? (await askForOtp())
+  if (!code) {
+    console.error(red("npm needs a one-time password and none was given."))
+    console.error(dim("  run it again with --otp=<the code from your authenticator app>"))
+    return { out: result.out, code: result.code }
+  }
+  state.otp = code
+  result = run([`--otp=${code}`])
+  return result
+}
+
+/**
+ * Ask for the one-time password.
+ *
+ * @returns {Promise<string | null>}
+ */
+async function askForOtp() {
+  if (!process.stdin.isTTY) {
+    console.error(
+      red("this needs a one-time password, and there is no terminal to ask for it on."),
+    )
+    console.error(dim(`  run it with --otp=<the code from your authenticator app>`))
+    return null
+  }
+  const { createInterface } = await import("node:readline/promises")
+  // The prompt goes to stderr, and it gets a line of its own: a question
+  // buried in the middle of npm's output is a question nobody answers.
+  process.stderr.write("\n")
+  const rl = createInterface({ input: process.stdin, output: process.stderr })
+  try {
+    const answer = (
+      await rl.question("  one-time password from your authenticator app: ")
+    ).trim()
+    process.stderr.write("\n")
+    return answer || null
+  } finally {
+    rl.close()
+  }
+}
+
 /**
  * The stored trusted publisher configurations for this package.
+ *
+ * A package with no configuration is not the same as a call that failed: the
+ * first is a fact and the second is a question, and treating the second as the
+ * first sends you off to create a configuration that already exists.
+ *
  * @param {string} name
- * @returns {any[]}
+ * @param {{ otp?: string }} [state]
+ * @returns {Promise<{ configs: any[], failed: boolean, detail?: string }>}
  */
-function listConfigs(name) {
-  const out = npm(["trust", "list", name, "--json"], { allowFail: true })
-  if (!out.trim()) return []
+async function listConfigs(name, state = {}) {
+  const { out, code } = await npmWithOtp(["trust", "list", name, "--json"], state)
+  if (code !== 0) {
+    // A package with no configuration answers 404, and a failed call answers
+    // with something else. They are different facts.
+    if (/E404|not found/i.test(out)) return { configs: [], failed: false }
+    return { configs: [], failed: true, detail: out }
+  }
+  if (!out.trim()) return { configs: [], failed: false }
   let parsed
   try {
     parsed = JSON.parse(out)
   } catch {
-    return []
+    return { configs: [], failed: true, detail: out }
   }
   const items = Array.isArray(parsed) ? parsed : parsed.configs ?? [parsed]
-  return items.filter(Boolean)
+  return { configs: items.filter(Boolean), failed: false }
 }
 
 /**
@@ -116,14 +205,17 @@ function describe(config) {
 
 /**
  * @param {string[]} argv
- * @returns {number} the exit code
+ * @returns {Promise<number>} the exit code
  */
-export function main(argv = []) {
+export async function main(argv = []) {
   const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"))
   const name = pkg.name
   const repo = repoOf(pkg.repository)
   const file = process.env.TRUSTED_PUBLISHER_FILE ?? "ci.yml"
   const checkOnly = argv.includes("--check")
+  // A code given on the command line is used as-is. A code given at the
+  // prompt is remembered for the rest of the run, so the user types it once.
+  const state = { otp: argv.find((a) => a.startsWith("--otp="))?.slice("--otp=".length) }
 
   console.log(`\n${bold("npm trusted publishing")}  ${dim(`${name} · ${repo} · ${file}`)}\n`)
 
@@ -143,7 +235,16 @@ export function main(argv = []) {
     return 1
   }
 
-  const configs = listConfigs(name)
+  const { configs, failed, detail } = await listConfigs(name, state)
+  if (failed && !configs.length) {
+    console.error(red("could not read the trusted publisher configuration."))
+    if (detail) {
+      console.error(dim("  npm said:"))
+      for (const line of detail.trim().split("\n").slice(-12)) console.error(dim("    " + line))
+    }
+    console.error(dim(`  run \`npm trust list ${name}\` to see the raw answer.`))
+    return 1
+  }
 
   if (!configs.length) {
     console.log(yellow("  no trusted publisher is configured for this package."))
@@ -155,18 +256,36 @@ export function main(argv = []) {
       return 1
     }
     console.log(`  creating it: ${file}, no environment, publish and stage\n`)
-    npm([
-      "trust",
-      "github",
-      name,
-      "--file",
-      file,
-      "--repo",
-      repo,
-      "--allow-publish",
-      "--allow-stage-publish",
-      "-y",
-    ])
+    const { out, code } = await npmWithOtp(
+      [
+        "trust",
+        "github",
+        name,
+        "--file",
+        file,
+        "--repo",
+        repo,
+        "--allow-publish",
+        "--allow-stage-publish",
+        "-y",
+      ],
+      state,
+    )
+    if (code !== 0) {
+      // Printing "configured" after a failed create is the worst thing this
+      // command could do: the user walks away believing the publish path is
+      // fixed, and finds out at the next release.
+      console.error(red("npm did not create the trusted publisher."))
+      if (/one-time password|EOTP/i.test(out)) {
+        console.error(dim("  run it again with --otp=<the code from your authenticator app>"))
+      }
+      const detail = out.trim()
+      if (detail) {
+        console.error(dim("  npm said:"))
+        for (const line of detail.split("\n").slice(-12)) console.error(dim("    " + line))
+      }
+      return 1
+    }
     console.log(`\n  ${green("✓")} the trusted publisher is configured\n`)
     return 0
   }
@@ -217,19 +336,35 @@ export function main(argv = []) {
       console.error("  revoke it on npmjs.com and run this again.")
       return 1
     }
-    npm(["trust", "revoke", name, "--id", id, "-y"])
-    npm([
-      "trust",
-      "github",
-      name,
-      "--file",
-      file,
-      "--repo",
-      repo,
-      "--allow-publish",
-      "--allow-stage-publish",
-      "-y",
-    ])
+    const revoked = await npmWithOtp(["trust", "revoke", name, "--id", id, "-y"], state)
+    if (revoked.code !== 0) {
+      console.error(red("npm did not revoke the old configuration, so nothing was replaced."))
+      return 1
+    }
+    const created = await npmWithOtp(
+      [
+        "trust",
+        "github",
+        name,
+        "--file",
+        file,
+        "--repo",
+        repo,
+        "--allow-publish",
+        "--allow-stage-publish",
+        "-y",
+      ],
+      state,
+    )
+    if (created.code !== 0) {
+      console.error(red("npm did not create the replacement configuration."))
+      const detail = created.out.trim()
+      if (detail) {
+        console.error(dim("  npm said:"))
+        for (const line of detail.split("\n").slice(-12)) console.error(dim("    " + line))
+      }
+      return 1
+    }
     console.log(`\n  ${green("✓")} the trusted publisher is configured\n`)
   }
   return 0